Security researchers have recently unearthed a supply-chain vulnerability within Bazel, one of Google’s flagship open-source products. The flaw centered around a command injection vulnerability in a dependent GitHub Actions workflow, potentially allowing malicious actors to insert harmful code into Bazel’s codebase.

Source: Infosecurity