Comment by josephcsible

Are any of them actually exploitable in the context of a GitLab runner that doesn't use them? This feels like a security company looking for ways to justify their existence.