x/vulndb: potential Go vuln in github.com/go-vela/worker: GHSA-pwx5-6wxg-px5h

[GoVulnBot]

In GitHub Security Advisory GHSA-pwx5-6wxg-px5h, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/go-vela/worker	0.23.2	<= 0.23.1

Cross references:

• Module github.com/go-vela/worker appears in issue x/vulndb: potential Go vuln in github.com/go-vela/worker: GHSA-5m7g-pj8w-7593 #1100 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/go-vela/worker
      versions:
        - introduced: TODO (earliest fixed "0.23.2", vuln range "<= 0.23.1")
      packages:
        - package: github.com/go-vela/worker
summary: Insecure Variable Substitution in Vela
cves:
    - CVE-2024-28236
ghsas:
    - GHSA-pwx5-6wxg-px5h
references:
    - advisory: https://github.com/go-vela/worker/security/advisories/GHSA-pwx5-6wxg-px5h
    - web: https://nvd.nist.gov/vuln/detail/CVE-2024-28236
    - fix: https://github.com/go-vela/worker/commit/e1572743b008e4fbce31ebb1dcd23bf6a1a30297
    - advisory: https://github.com/advisories/GHSA-pwx5-6wxg-px5h

[gopherbot]

Change https://go.dev/cl/582358 mentions this issue: data/reports: batch add 11 unreviewed reports

[gopherbot]

Change https://go.dev/cl/586484 mentions this issue: data/reports: add 73 unreviewed reports

[gopherbot]

Change https://go.dev/cl/590039 mentions this issue: data/reports: add 51 reports

[gopherbot]

Change https://go.dev/cl/606358 mentions this issue: data/reports: regenerate 50 reports