AIKIDO-2026-54614

TL;DR

The tagFormat option and branch configuration string fields are compiled with the Lodash template function while the default evaluate delimiter stays enabled. Because <% ... %> sequences are treated as executable JavaScript, a template value containing such syntax runs arbitrary code inside the release process. An actor able to influence these configuration values, for example through a shared or extended configuration, can execute code and read secrets in the CI environment where the tool runs. The fix compiles these templates with evaluate and escape disabled so evaluation syntax is preserved literally instead of being executed.