Threats tagged 'ghsa-whr6-fgpq-fpv9'

compose-lint versions prior to 0.25.0 follow symlinks when reading project files, potentially exposing contents of files outside the project in its output. This can occur when a pull request commits a symlink pointing to sensitive files on the CI runner. The exposure includes quoted lines from non-YAML files and key names from env_file targets, visible in job logs and code scanning outputs. The issue is fixed starting from version 0.25.0, which restricts symlink resolution outside the project and removes quoted source lines from parse errors.