{"id":"CVE-2026-125121","kind":"vulnerability","aliases":["CVE-2026-125121","GHSA-r7j4-crjv-h467"],"related":[],"title":"compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output","description":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report \"escapes both openers (also covering Azure Pipelines)\". Five paths were left open:\n\n- **Unicode whitespace before a line-leading `::`.** The runner strips all Unicode whitespace from the start of a line before it looks for a command. compose-lint only accounted for spaces and tabs, so a no-break space or another Unicode space ahead of `::` is not escaped. It can come from a Compose value, or from a file name: the text report's file heading and per-file summary, and the `fix` summary on stderr, start with the path as given, so a directory named with a leading no-break space followed by `::` puts a command at the start of a line. This reaches those lines, the text report's fix guidance, the `fix` dry-run diff, and continuation lines of stderr diagnostics.\n- **JSON and SARIF printed to stdout.** `--format json` and `--format sarif` output never passed through the sanitizer, so `##[` inside a service name or other value reaches the log intact when the output isn't redirected to a file.\n- **Command-line errors.** When a repository path reaches compose-lint's arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.\n- **Azure Pipelines.** `##vso[` logging commands were not escaped on any path, despite the changelog's Azure claim.\n- **An error message in the GitHub Action (0.30.0 and 0.31.0).** When `sarif-file:` names a file in a subdirectory that can't be created, the Action prints the directory's resolved path in an error message, outside the window in which it turns command processing off. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command. The documented setup, `sarif-file: results.sarif` at the repository root, is not affected.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups are those that print compose-lint's output to a CI log without the GitHub Action: the `compose-lint` package run directly in a workflow, the pre-commit hook run in CI, and the Docker image. The pre-commit hook is affected in its default configuration: it passes each changed file's path to compose-lint, and a path whose directory name starts with Unicode whitespace and `::` reaches the report's file heading. The JSON/SARIF and command-line paths also need output left on stdout, or `args:` without the documented trailing `--`, which is why they alone would score lower. The GitHub Action turns command processing off around each compose-lint run, so of these paths only its own error message affects it, and only when `sarif-file:` points into a subdirectory. That setup is outside the documented one, which is why that path alone would also score lower.\n\nFound during an internal pre-1.0 security review.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0, the matching minor tag, and `latest` are affected.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6, except the Action's error message, which also affects Action 0.30.0.\n\n### Patches\n\nFixed in 0.32.0. The line-start escaping covers every character the runner strips before `::`, so it holds for quoted values and file names alike. JSON and SARIF on stdout escape `##[` inside strings as `\\u005b`, which decodes to the same data. argparse's own messages go through the same sanitizer. `##vso[` is escaped everywhere. In the Action, the SARIF-directory error names the `sarif-file:` input as written.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::<random token>` and `::<token>::`, as the Action does.\n- In the Action, keep `sarif-file` at the workspace root, for example `sarif-file: results.sarif`.\n- Write `--format json` and `--format sarif` output to a file rather than the log.\n- End the pre-commit hook's `args:` with `--`. This closes the command-line path only; it does not stop a file name at the start of a report line, so in CI also bracket the pre-commit step with `::stop-commands::` as above.\n- On Azure Pipelines, don't print compose-lint's output from runs over untrusted pull requests to the job log.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), each of the following creates an annotation:\n\n- a Compose file with `image: \"nginx\\n\\u00a0::notice::X\"`, linted with the text report;\n- a directory named `\\u00a0::notice::X` (a no-break space, then `::notice::X`) holding a `compose.yml`, linted with `compose-lint -- '<that directory>/compose.yml'`, or by the pre-commit hook in its default configuration;\n- a service named `a##[warning]X`, linted with `--format json` or `--format sarif` to stdout;\n- `compose-lint '--##[warning]X/compose.yml'` with no `--`;\n- the Action with `sarif-file: out/reports/results.sarif`, where `out` is a committed symlink to a directory named `d\\n::warning::X` that contains a regular file `reports`.\n\nThe same inputs with a plain space in place of the no-break space, or with `--` before the path, or with `sarif-file` at the repository root, create none. The same inputs on compose-lint 0.30.0 create annotations even with a plain space, which is GHSA-6f4g-xm8v-pgv6. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","summary":"compose-lint 0.31.0 still lets text from a Compose file or a directory name become GitHub Actions workflow commands in its output, because several escape paths were missed. A pull request can use this to create annotations, hide parts of the job log, or issue other commands the runner accepts when CI lints it.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"compose-lint","fixed":["0.32.0"],"affected":">= 0.31.0, < 0.32.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ci","compose-lint","cwe-117","cwe-150","docker-compose","github-actions","package","pre-commit","pypi"],"not_affected_if":["action-sarif-file-at-root","args-end-with-double-dash","json-or-sarif-written-to-file","pre-commit-not-run-in-ci"],"how_to_check":"- Run `compose-lint --version` in CI or on the machine that runs it and check whether it is `0.31.0` or later but below `0.32.0`.\n- Check the pinned version of the `compose-lint` package, the pre-commit hook revision, and the `composelint/compose-lint` Docker image tag in workflow files.\n- Check whether the GitHub Action `tmatens/compose-lint` sets `sarif-file:` to a path in a subdirectory.","fix":null,"status":"open","published_at":"2026-11-10T17:17:26+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","triaged_at":"2026-11-10T18:32:45+00:00","updated_at":"2026-11-10T18:32:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T18:32:45Z","model":"claude-haiku-5-5","output":{"fix":"- `compose-lint` package: `0.32.0`\n- Docker image `composelint/compose-lint`: move to a tag that includes `0.32.0`, as the sources state the fix is in 0.32.0","reach":"internet","title":"compose-lint: pull request text can issue CI workflow commands in logs","impact":"medium","summary":"compose-lint 0.31.0 still lets text from a Compose file or a directory name become GitHub Actions workflow commands in its output, because several escape paths were missed. A pull request can use this to create annotations, hide parts of the job log, or issue other commands the runner accepts when CI lints it.","audience":"developers","category":"package","nicknames":[],"who_cares":["compose-lint","pypi","docker-compose","github-actions","pre-commit","ci"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Pull request text creates CI annotations and hides or injects job log lines.","analyst_note":"","how_to_check":"- Run `compose-lint --version` in CI or on the machine that runs it and check whether it is `0.31.0` or later but below `0.32.0`.\n- Check the pinned version of the `compose-lint` package, the pre-commit hook revision, and the `composelint/compose-lint` Docker image tag in workflow files.\n- Check whether the GitHub Action `tmatens/compose-lint` sets `sarif-file:` to a path in a subdirectory.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["json-or-sarif-written-to-file","action-sarif-file-at-root","args-end-with-double-dash","pre-commit-not-run-in-ci"],"who_is_affected":"Teams that run compose-lint directly in a CI workflow, run its pre-commit hook in CI, or use the Docker image, and print its output to a CI job log. The GitHub Action is affected only through its own error message, and only when `sarif-file:` points into a subdirectory. Teams that write JSON or SARIF output to a file, or that run the Action with `sarif-file` at the repository root, are not exposed through the other paths. Releases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001074,"input_tokens":6675,"output_tokens":813,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1.0':685C '-117':41B '-125121':24A,32A '-150':43B '-2026':23A,31A '0.30.0':406C,722C '0.31.0':19A,58B,110C,148C,408C,692C,703C '0.32.0':726C,797C '6f4g':114C,709C 'accept':105B,503C 'account':194C 'action':49B,72B,125C,405C,425C,540C,631C,714C,721C,780C 'affect':481C,522C,569C,651C,700C,720C 'ahead':209C 'alik':748C 'alon':625C,675C 'also':156C,376C,609C,677C,719C 'annot':92B,488C 'anoth':206C 'anyon':513C 'arg':616C 'argpars':765C 'argument':344C,350C 'around':636C 'azur':158C,382C,397C 'becam':123C 'becom':70B 'break':203C,258C,371C 'carriag':362C 'chang':521C,577C 'changelog':149C,395C 'charact':734C 'ci':12A,36B,107B,505C,535C,558C 'claim':398C 'come':216C 'command':14A,74B,102B,127C,138C,189C,264C,332C,374C,386C,443C,467C,500C,606C,633C 'command-lin':331C,605C 'commit':53B,450C,554C,566C 'compos':2A,17A,38B,46B,56B,64B,121C,130C,143C,191C,219C,341C,508C,529C,543C,583C,639C 'compose':34A 'compose-lint':1A,16A,33A,37B,55B,129C,142C,190C,340C,507C,528C,542C,582C,638C 'composelint/compose-lint':690C 'configur':573C 'contain':461C 'continu':288C 'cover':157C,705C,732C 'creat':91B,423C,487C 'crjv':28A 'cve':22A,30A 'cwe':40B,42B 'data':764C 'decod':760C 'default':572C 'despit':393C 'diagnost':292C 'diff':286C 'direct':547C 'directori':68B,251C,428C,458C,589C,784C 'docker':45B,561C,688C 'docker-compos':44B 'document':469C,619C,668C 'dri':284C 'dry-run':283C 'error':334C,357C,400C,434C,649C,716C,785C 'escap':80B,136C,153C,213C,389C,731C,754C,776C 'everi':733C 'everyth':141C 'everywher':777C 'except':712C 'file':65B,122C,224C,230C,235C,330C,412C,415C,473C,578C,600C,658C,746C,790C 'five':160C 'fix':111C,135C,239C,279C,282C,724C 'fold':489C 'follow':260C,464C 'format':299C,302C 'found':680C 'ghsa':26A,113C,708C 'ghsa-6f4g-xm8v-pgv6':112C,707C 'ghsa-r7j4-crjv-h467':25A 'github':48B,71B,124C,404C,539C,630C 'github-act':47B 'given':248C 'go':769C 'guidanc':280C 'h467':29A 'head':231C,601C 'hide':93B,491C 'hold':741C 'hook':555C,567C 'imag':562C,689C 'impact':109C 'includ':360C 'input':791C 'insid':311C,755C 'intact':321C 'intern':683C 'isn':325C 'issu':11A,100B,498C 'job':97B,495C 'json':293C,300C,749C 'json/sarif':603C 'later':799C 'latest':698C 'lead':171C,255C 'left':163C,612C 'let':60B 'line':170C,183C,270C,274C,289C,333C,370C,380C,607C,729C 'line-lead':169C 'line-start':728C 'lint':3A,18A,35A,39B,57B,108B,131C,144C,192C,342C,509C,530C,544C,584C,640C 'log':98B,320C,385C,496C,536C 'look':186C 'lower':628C,679C 'match':694C 'messag':358C,401C,435C,650C,717C,768C 'minor':695C 'miss':83B 'name':69B,225C,252C,314C,413C,460C,590C,747C,786C 'need':610C 'never':305C 'new':379C 'newlin':463C 'no-break':201C,256C 'one':669C 'open':139C,155C,164C 'output':21A,77B,133C,304C,324C,532C,611C 'outsid':436C,666C 'packag':50B,545C 'parser':351C 'part':94B,492C 'pass':306C,575C 'pass/fail':517C 'patch':723C 'path':81B,161C,246C,338C,392C,431C,455C,580C,587C,608C,645C,674C 'per':234C 'per-fil':233C 'pgv6':116C,711C 'pipelin':159C,383C 'point':659C 'pre':52B,553C,565C,684C 'pre-commit':51B,552C,564C 'print':145C,296C,352C,426C,527C 'process':444C,634C 'pull':7A,85B,447C,483C 'put':262C 'pypi':54B 'quot':743C 'r7j4':27A 'raw':354C 'reach':272C,318C,339C,596C 'redirect':327C 'releas':701C 'report':152C,228C,277C,598C 'repositori':337C,477C 'request':8A,86B,448C,484C 'resolv':430C 'result':518C 'results.sarif':474C 'return':363C 'review':514C,687C 'root':478C 'run':285C,506C,546C,556C,641C 'runner':104B,173C,366C,502C,736C 'sanit':309C,773C 'sarif':295C,303C,411C,472C,657C,751C,783C,789C 'sarif-directori':782C 'sarif-fil':410C,471C,656C,788C 'say':150C 'score':627C,678C 'secur':686C 'servic':313C 'setup':470C,523C,664C 'sever':79B 'space':196C,204C,208C,259C 'start':180C,243C,267C,377C,591C,730C 'stderr':242C,291C 'stdout':298C,614C,753C 'still':10A,59B 'string':756C 'strip':174C,737C 'subdirectori':418C,662C 'summari':236C,240C 'symlink':452C 'tab':198C 'tag':691C,696C 'text':4A,61B,118C,227C,276C 'therefor':486C 'trail':620C 'treat':367C 'turn':442C,632C 'u005b':758C 'unicod':165C,176C,207C,593C 'upgrad':795C 'use':88B 'valu':220C,317C,744C 'vso':384C,774C 'whitespac':166C,177C,594C 'whose':459C,588C 'window':438C 'without':345C,537C,617C 'workaround':794C 'workflow':13A,73B,126C,550C 'would':626C,676C 'written':793C 'xm8v':115C,710C","nicknames":[],"mitigations":[],"who_affected":"Teams that run compose-lint directly in a CI workflow, run its pre-commit hook in CI, or use the Docker image, and print its output to a CI job log. The GitHub Action is affected only through its own error message, and only when `sarif-file:` points into a subdirectory. Teams that write JSON or SARIF output to a file, or that run the Action with `sarif-file` at the repository root, are not exposed through the other paths. Releases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["composelint"],"ptokens":["compose","lint"],"labels":["ci","composelint","cwe117","cwe150","dockercompose","githubactions","medium","package","precommit","pypi"],"campaign_type":null,"search_a":"'-125121':24A,32A '-2026':23A,31A '0.31.0':19A 'ci':12A 'command':14A 'compos':2A,17A 'compose':34A 'compose-lint':1A,16A,33A 'crjv':28A 'cve':22A,30A 'ghsa':26A 'ghsa-r7j4-crjv-h467':25A 'h467':29A 'issu':11A 'lint':3A,18A,35A 'output':21A 'pull':7A 'r7j4':27A 'request':8A 'still':10A 'text':4A 'workflow':13A","search_b":"'-117':41B '-150':43B '0.31.0':58B 'accept':105B 'action':49B,72B 'annot':92B 'becom':70B 'ci':36B,107B 'command':74B,102B 'commit':53B 'compos':38B,46B,56B,64B 'compose-lint':37B,55B 'creat':91B 'cwe':40B,42B 'directori':68B 'docker':45B 'docker-compos':44B 'escap':80B 'file':65B 'github':48B,71B 'github-act':47B 'hide':93B 'issu':100B 'job':97B 'let':60B 'lint':39B,57B,108B 'log':98B 'miss':83B 'name':69B 'output':77B 'packag':50B 'part':94B 'path':81B 'pre':52B 'pre-commit':51B 'pull':85B 'pypi':54B 'request':86B 'runner':104B 'sever':79B 'still':59B 'text':61B 'use':88B 'workflow':73B","search_c":"'-1.0':685C '0.30.0':406C,722C '0.31.0':110C,148C,408C,692C,703C '0.32.0':726C,797C '6f4g':114C,709C 'accept':503C 'account':194C 'action':125C,405C,425C,540C,631C,714C,721C,780C 'affect':481C,522C,569C,651C,700C,720C 'ahead':209C 'alik':748C 'alon':625C,675C 'also':156C,376C,609C,677C,719C 'annot':488C 'anoth':206C 'anyon':513C 'arg':616C 'argpars':765C 'argument':344C,350C 'around':636C 'azur':158C,382C,397C 'becam':123C 'break':203C,258C,371C 'carriag':362C 'chang':521C,577C 'changelog':149C,395C 'charact':734C 'ci':505C,535C,558C 'claim':398C 'come':216C 'command':127C,138C,189C,264C,332C,374C,386C,443C,467C,500C,606C,633C 'command-lin':331C,605C 'commit':450C,554C,566C 'compos':121C,130C,143C,191C,219C,341C,508C,529C,543C,583C,639C 'compose-lint':129C,142C,190C,340C,507C,528C,542C,582C,638C 'composelint/compose-lint':690C 'configur':573C 'contain':461C 'continu':288C 'cover':157C,705C,732C 'creat':423C,487C 'data':764C 'decod':760C 'default':572C 'despit':393C 'diagnost':292C 'diff':286C 'direct':547C 'directori':251C,428C,458C,589C,784C 'docker':561C,688C 'document':469C,619C,668C 'dri':284C 'dry-run':283C 'error':334C,357C,400C,434C,649C,716C,785C 'escap':136C,153C,213C,389C,731C,754C,776C 'everi':733C 'everyth':141C 'everywher':777C 'except':712C 'file':122C,224C,230C,235C,330C,412C,415C,473C,578C,600C,658C,746C,790C 'five':160C 'fix':111C,135C,239C,279C,282C,724C 'fold':489C 'follow':260C,464C 'format':299C,302C 'found':680C 'ghsa':113C,708C 'ghsa-6f4g-xm8v-pgv6':112C,707C 'github':124C,404C,539C,630C 'given':248C 'go':769C 'guidanc':280C 'head':231C,601C 'hide':491C 'hold':741C 'hook':555C,567C 'imag':562C,689C 'impact':109C 'includ':360C 'input':791C 'insid':311C,755C 'intact':321C 'intern':683C 'isn':325C 'issu':498C 'job':495C 'json':293C,300C,749C 'json/sarif':603C 'later':799C 'latest':698C 'lead':171C,255C 'left':163C,612C 'line':170C,183C,270C,274C,289C,333C,370C,380C,607C,729C 'line-lead':169C 'line-start':728C 'lint':131C,144C,192C,342C,509C,530C,544C,584C,640C 'log':320C,385C,496C,536C 'look':186C 'lower':628C,679C 'match':694C 'messag':358C,401C,435C,650C,717C,768C 'minor':695C 'name':225C,252C,314C,413C,460C,590C,747C,786C 'need':610C 'never':305C 'new':379C 'newlin':463C 'no-break':201C,256C 'one':669C 'open':139C,155C,164C 'output':133C,304C,324C,532C,611C 'outsid':436C,666C 'packag':545C 'parser':351C 'part':492C 'pass':306C,575C 'pass/fail':517C 'patch':723C 'path':161C,246C,338C,392C,431C,455C,580C,587C,608C,645C,674C 'per':234C 'per-fil':233C 'pgv6':116C,711C 'pipelin':159C,383C 'point':659C 'pre':553C,565C,684C 'pre-commit':552C,564C 'print':145C,296C,352C,426C,527C 'process':444C,634C 'pull':447C,483C 'put':262C 'quot':743C 'raw':354C 'reach':272C,318C,339C,596C 'redirect':327C 'releas':701C 'report':152C,228C,277C,598C 'repositori':337C,477C 'request':448C,484C 'resolv':430C 'result':518C 'results.sarif':474C 'return':363C 'review':514C,687C 'root':478C 'run':285C,506C,546C,556C,641C 'runner':173C,366C,502C,736C 'sanit':309C,773C 'sarif':295C,303C,411C,472C,657C,751C,783C,789C 'sarif-directori':782C 'sarif-fil':410C,471C,656C,788C 'say':150C 'score':627C,678C 'secur':686C 'servic':313C 'setup':470C,523C,664C 'space':196C,204C,208C,259C 'start':180C,243C,267C,377C,591C,730C 'stderr':242C,291C 'stdout':298C,614C,753C 'string':756C 'strip':174C,737C 'subdirectori':418C,662C 'summari':236C,240C 'symlink':452C 'tab':198C 'tag':691C,696C 'text':118C,227C,276C 'therefor':486C 'trail':620C 'treat':367C 'turn':442C,632C 'u005b':758C 'unicod':165C,176C,207C,593C 'upgrad':795C 'valu':220C,317C,744C 'vso':384C,774C 'whitespac':166C,177C,594C 'whose':459C,588C 'window':438C 'without':345C,537C,617C 'workaround':794C 'workflow':126C,550C 'would':626C,676C 'written':793C 'xm8v':115C,710C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-28T16:12:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125121","severity":null,"published_at":"2026-11-10T17:17:26+00:00","modified_at":"2026-11-10T17:17:26+00:00","first_seen_at":"2026-11-10T17:22:40+00:00","fetched_at":"2026-11-10T17:22:40+00:00","note":null},{"source":"ghsa","external_id":"GHSA-r7j4-crjv-h467","url":"https://github.com/advisories/GHSA-r7j4-crjv-h467","severity":"medium","published_at":"2026-11-10T18:28:35+00:00","modified_at":"2026-11-10T18:28:38+00:00","first_seen_at":"2026-11-10T18:31:48+00:00","fetched_at":"2026-11-10T18:51:58+00:00","note":null}],"documents":[{"id":116493,"url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108802,"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116495,"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-28T16:12:10+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":117083,"url":"https://api.github.com/repos/tmatens/compose-lint/security-advisories/GHSA-r7j4-crjv-h467","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":117085,"url":"https://github.com/tmatens/compose-lint/pull/945","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}