GHSA-R7J4-CRJV-H467 compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report "escapes both openers also covering Azure...

compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report "escapes both openers also covering Azure...

krane

Krane Kubernetes RBAC Analysis made Easy Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its...

CVE-2026-125122

The compose-lint Docker Compose security linter (version 0.31.0 ) fails to sanitize the ##[ workflow-command opener within strings when using the --format json or --format sarif flags to stdout. An attacker could include this opener in a pull request via a service name or other Compose value. Whe...

CVE-2026-125121 compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before...

CVE-2026-125121

The compose-lint security linter for Docker Compose is vulnerable in version 0.31.0 . The root cause is that the tool only escapes GitHub Actions workflow-command openers after ASCII spaces and tabs , whereas the runner strips leading Unicode whitespace . Consequently, untrusted Compose values or...

compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the $NAME a sibling .env filled in, instead of its value. The same release added a stop at 20,000 findings per document, and that stop is checked before the quoting step. A run that hits it reports the findings...

GHSA-RM8W-W798-G545 compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the $NAME a sibling .env filled in, instead of its value. The same release added a stop at 20,000 findings per document, and that stop is checked before the quoting step. A run that hits it reports the findings...

GHSA-WHR6-FGPQ-FPV9 compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output

Impact Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from outside the project into its output, where the author of a pull request can read it. A pull request can commit a symlink,...

GHSA-6WCV-RJ3C-MHV3 compose-lint: .env read through a symlink outside the project can expose the CI job's environment

Impact compose-lint fills in $VAR references from the .env file next to the Compose file. It is meant to read nothing outside the project directory, and envfile:, include: and extends: paths are checked for that. The .env read is not. If .env is a symlink, compose-lint follows it wherever it...

compose-lint: .env read through a symlink outside the project can expose the CI job's environment

Impact compose-lint fills in $VAR references from the .env file next to the Compose file. It is meant to read nothing outside the project directory, and envfile:, include: and extends: paths are checked for that. The .env read is not. If .env is a symlink, compose-lint follows it wherever it...

dockle

Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start Dockle helps you: 1. Build Best Practice Docker images 2. Build secure Docker images Checkpoints includes CIS Benchmarks $ brew untap goodwithtech/dockle who use 0.1.16 or older version $ bre...

CVE-2026-124039

A flaw was found in Gitleaks. When generating scan reports, the application creates output files with overly permissive default file permissions. A local user on a shared host or continuous integration CI environment can read these report files to obtain discovered plaintext credentials and...

GitLeaks

GitLeaks Container Image Opinionated gitleaks build for secret scanning in local workflows and pipelines. Features Builds gitleaks from the tagged upstream source with pinned Go toolchains for reproducible binaries. GitLab CI Component at niclas-zone/ci/gitleaks. Usage Pull the image podman pull...

cicd-sensor

🚧 Pre-release: Active development. cicd-sensor is currently in pre-release and under active development. Feedback is very welcome. cicd-sensor Think EDR, but for CI/CD Pipelines. Open-source eBPF-powered runtime security sensor for GitHub Actions and GitLab CI/CD. → Full documentation Demo ---...

GitLeaks

GitLeaks GitLab CI Component A GitLab CI component for Gitleaks - a SAST tool for detecting and preventing hardcoded secrets like passwords, API keys, and tokens in git repos. Features Secret Detection : Scans repositories for hardcoded secrets and sensitive information Comprehensive Rules :...

Dependency Scanning

Component for Dependency and License Scanning This component generates a CycloneDX Software Bill of Materials, which is used by GitLab to identify a project's dependencies, and their licenses. This CycloneDX Software Bill of Materials is compatible with the GitLab taxonomy. Additionally, this...

kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the online demo source...

scorecard

OpenSSF Scorecard Overview What Is Scorecard? Prominent Scorecard Users View a Project's Score Scorecard's Public Data Using Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard MCP Server Scorecard Command Line Interface Prerequisites Installation Authentication Basic...

strix

Strix The open-source AI pentesting tool. Autonomous AI hackers that find and fix your app’s vulnerabilities. !TIP New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure cod...