The `stack.yml` file given as an example to run a drupal infrastructure uses a version vulnerable to drupalgeddon2 (8.2). Vulnerable versions are listed here: https://www.drupal.org/sa-core-2018-002