melange pipeline working-directory could allow command injection

An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses ${{vars.*}} or ${{inputs.*}} substitutions in working-directory. The field is embedded into shell scripts without proper quote escaping.

Fix: Fixed with e51ca30c, Released.

Acknowledgements

melange thanks Oleh Konko from 1seal for discovering and reporting this issue.