--format=gh-annotations: unsanitized \r enables GitHub Actions workflow command injection

[djvirus9]

• Body:
  Summary

  osv-scanner --format=gh-annotations sanitizes \n → %0A but does not sanitize \r. GitHub Actions runners treat \r as a line boundary for workflow command parsing, enabling injection of ::warning::, ::add-mask::, ::set-output:: etc. into any CI pipeline using this flag.

Reproduction

MALICIOUS=$(printf 'scan\r::warning::INJECTED_BY_ATTACKER')
mkdir -p "$MALICIOUS" && cp package-lock.json "$MALICIOUS/"
osv-scanner --format=gh-annotations "$MALICIOUS/package-lock.json" | cat -v

Live GitHub Actions confirmation (injected annotation visible in logs):

https://github.com/djvirus9/osv-injection-poc/actions

Root cause

internal/output/githubannotation.go — \r not sanitized in
renderedTable or artifactPath before fmt.Fprintf into ::error file=.

Fix

A PR with the fix is open: [https://github.com//pull/2669]