Threats tagged 'ghsa-6f4g-xm8v-pgv6'

The compose-lint GitHub Action prior to version 0.31.0 outputs text that can be interpreted by the GitHub Actions runner as workflow commands. This allows a malicious Compose file in a pull request to inject commands that create fake error or warning annotations, fold logs to hide real verdicts, or mask strings in the log output. The issue arises because the Action does not neutralize the legacy command syntax '##[' in its text report output. The vulnerability was fixed in version 0.31.0 by escaping these sequences and using a stop-commands token to prevent command processing during output.