isula-build before 0.9.5-6 can cause a program crash, when building container images, some functions for processing external data do not remove spaces when processing data.

iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.

When malicious images are pulled by isula pull, attackers can execute arbitrary code.

When the isula load command is used to load malicious images, attackers can execute arbitrary code.

When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container.

When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the container.

When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free).

When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function.