Shell injection vulnerabilities in multiple execPromise calls #8
Labels
No labels
blocked:lint-failed
blocked:needs-decision
blocked:no-changes
blocked:verify-failed
bug
feature-request
needs-triage
ops-task
quickfix
security/high
test-coverage
triage-approved
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Mark/compose_dash#8
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
User-controlled values (volume names, file paths, compose file names) interpolated into shell commands without escaping. Volume names with spaces/$/backticks execute arbitrary commands.
Fixed in commit. Closing.