Threats tagged 'ghsa-8v59-qmwv-4p6q'

compose-lint versions 0.31.0 up to but not including 0.32.0 contain a vulnerability where file paths embedded in pull requests can inject GitHub Actions workflow commands via command-line error messages. This occurs because the argument parser outputs unescaped repository paths in error messages, allowing specially crafted input to create annotations or manipulate job logs in CI workflows. The issue does not affect the pass/fail result of compose-lint runs. The vulnerability is fixed in version 0.32.0.