Threats tagged 'ghsa-rm8w-w798-g545'

compose-lint version 0.32.0 contains an incomplete fix for a previous secret exposure vulnerability (GHSA-jf3h-8jvx-vcrg). When a run exceeds 20,000 findings, the process stops before masking secret values, causing secrets from a sibling .env file to be exposed in output formats including text logs, JSON, and SARIF reports. This can occur in CI workflows that write secrets into the .env file beside the Compose file and lint pull requests from untrusted authors. No fixed release was available at the time of disclosure, but version 0.33.0 addresses this issue.