Threats tagged 'ghsa-hr4h-4c45-v4q4'

compose-lint versions 0.31.0 up to but not including 0.32.0 allow specially crafted text in a pull request to inject GitHub Actions workflow commands via JSON or SARIF output printed to stdout. This can cause the CI runner to create annotations, fold logs, or execute other accepted commands without changing the pass/fail result. The issue does not affect output written to files or the official GitHub Action, which disables command processing around compose-lint runs. The vulnerability is fixed in version 0.32.0.