Code execution via container image entrypoint

Code execution in kube-compare used by Red Hat Pen Drive powered by Red Hat Lightspeed allows attackers to run a crafted image entrypoint. The container:// reference loader starts an untrusted image instead of extracting reference files from a stopped container. An operator must select an attacker-controlled image; Red Hat documents a mounted local baseline for this product, so exposure of the container:// path in its workflow remains unconfirmed.