Threats tagged 'ghsa-88f4-frh5-gmcr'

compose-lint versions from 0.2.0 up to but not including 0.32.0 automatically read a .compose-lint.yml policy file beside the Compose file. If this file is a symlink pointing outside the project directory, compose-lint follows it and reads the target file. When the target file contains invalid YAML, the parse error message includes a quoted snippet of the target file's content, exposing about 30 characters around the error line. This can leak small fragments of sensitive data, such as credentials, to pull request authors via job logs and code scanning uploads. The issue is fixed in version 0.32.0, which refuses to read symlinked policy files resolving outside the working directory and no longer quotes parse error lines.