Code injection vulnerability in OZI-Project/ozi-publish
OZI-Project/ozi-publish versions 1.13.2 through 1.13.5 contained a code injection vulnerability in pull request creation logic where untrusted branch names could inject arbitrary code. The vulnerability was patched in version 1.13.6.
What happened
Versions 1.13.2 through 1.13.5 of OZI-Project/ozi-publish contained a code injection vulnerability in PR creation logic, where untrusted data from branch names could flow into code generation without proper neutralization.
A malicious actor could construct a branch name to inject arbitrary code.
Governance controls
The vulnerability was patched in version 1.13.6.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.