important · Research — developer tooling
Repository-controlled projen inputs can become commands on developer and CI hosts.
Affects
projen, a project-configuration and task-generation framework used on developer systems and CI runners.
Shell metacharacters from configuration values or filenames were copied without escaping into generated task commands that a developer or CI job could later run.
Detail and 3 sources
Upgrading projen does not replace already-generated vulnerable task files.