Hacker News Reader

> On a recent project we gained the ability to specify environment variables

> We were also unable to control the contents of a file on disk

From the first and second sentence.

That's my point. What "recent project"? Is there a CVE?

Elttam are a security firm who offer (among other things) pentesting - so they would usually be working privately with, say, a client's website.

One wouldn't usually file a CVE in these circumstances, if only the client is affected.