Threats tagged 'ghsa-jf3h-8jvx-vcrg'

compose-lint versions 0.22.0 through 0.31.0 can inadvertently disclose secret values from a CI-generated .env file when those secrets are referenced in the image field of a Docker Compose file. This occurs because compose-lint resolves ${VAR} references from the .env file and includes the resolved values in its findings, logs, JSON output, and SARIF reports. Although GitHub masks secrets in job logs, it does not mask them in uploaded JSON or SARIF artifacts or Code Scanning alert text, potentially exposing secrets in pull request workflows that have access to the .env file. The issue is fixed in version 0.32.0, which quotes the variable reference instead of the resolved secret value in outputs.