[GHSA-r79c-pqj3-577x] Super-linter is vulnerable to command injection via crafted filenames in Super-linter Action

[identity-wael]

Updates

• References

Comments
Add the upstream commit addressing the filename command-substitution path described in CVE-2026-25761.

The referenced v8.3.1 release lists commit d29d0d4ffb9e0d5f71026f616ba31b1228b772fa (PR #7273, 'fix: handle paths with parentheses'): https://github.com/super-linter/super-linter/releases/tag/v8.3.1

In lib/functions/buildFileList.sh, this patch replaces the file-list pipeline that substitutes repository filenames into xargs -I % sh -c with a sed prefixing operation and loads the result using mapfile. This removes shell interpretation of filenames at that point.

I checked the before/after pipelines in an isolated temporary local Git repository using a harmless tracked filename $(printf PROBE).txt. The old pipeline returned a path ending in PROBE.txt, demonstrating evaluation of the command substitution. The patched pipeline preserved the literal $(printf PROBE).txt. This was a focused local check of the changed pipeline, not a full GitHub Actions workflow test.

The advisory already references the release but does not directly link this relevant patch. Adding the commit makes it easier to inspect the fix and assess downstream backports. No changes to affected versions, severity, or description are proposed.

[github]

Hi there @ferrarimarco! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory