3 results · Clear filters · Feed
-
Medium 5.3
compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leadi…
-
Medium 5.1
compose-lint: `fix --apply` can delete a line the user did not select, including a security setting
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line…
-
Medium 5.3
compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing G…