Authenticated command execution via unsanitized Docker reference

Command injection in nexB ScanCode.io 32.5.0 and earlier allows remote authenticated users to execute shell commands via Docker image input. The fetch_docker_image path passes user-controlled docker_reference text to get_docker_image_platform, which builds a Skopeo command that pipes.run_command executes through a shell without sanitization. Project input privileges are required; injection is blind unless logs are visible, but commands run in the server or container context and can read, alter, or interrupt its resources.