Threats tagged 'ghsa-xcf7-88g6-7xr8'

A command injection vulnerability exists in compose-lint Action versions 0.30.0 and 0.31.0 when the sarif-file input points to a file in a subdirectory that cannot be created. This allows a pull request to introduce symlinks with directory names containing newline and command sequences, causing the Action to execute unintended workflow commands such as creating annotations or folding job logs. The issue is fixed in version 0.32.0. The vulnerability does not affect setups where sarif-file is at the repository root.