Threats tagged 'ghsa-6wcv-rj3c-mhv3'

compose-lint versions from 0.22.0 up to but not including 0.31.0 improperly follow symlinks when reading the .env file, allowing a symlink outside the project directory to be read. This can expose environment variables from the CI runner, including secrets in certain configurations, via log outputs in JSON or SARIF formats. The issue is fixed in version 0.31.0 by enforcing containment checks on .env reads and refusing .env files that resolve outside the project directory.