{"id":"CVE-2026-125122","kind":"vulnerability","aliases":["CVE-2026-125122"],"related":[],"title":"compose-lint: unsanitized workflow commands in JSON and SARIF output","description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.","summary":"compose-lint 0.31.0 does not escape the GitHub Actions workflow-command opener when it prints JSON or SARIF to stdout. A pull request that puts that text into a Compose value can make the Actions runner act on it when the output lands in the job log.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","docker-compose","github-actions","package"],"not_affected_if":["file-output","github-action","not-0.31.0"],"how_to_check":"- Check the installed compose-lint version with `compose-lint --version` or the package manager's list command; `0.31.0` is affected.\n- Look for CI jobs that run compose-lint with `--format json` or `--format sarif` and print stdout to the job log instead of writing a file.\n- Check whether the compose-lint GitHub Action is used instead; the sources say it is not affected.","fix":"- compose-lint: move to `0.32.0`","status":"open","published_at":"2026-11-10T17:17:26+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","triaged_at":"2026-11-10T17:25:50+00:00","updated_at":"2026-11-10T17:25:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T17:25:50Z","model":"claude-haiku-5-5","output":{"fix":"- compose-lint: move to `0.32.0`","reach":"internet","title":"compose-lint: unsanitized workflow commands in JSON and SARIF output","impact":"low","summary":"compose-lint 0.31.0 does not escape the GitHub Actions workflow-command opener when it prints JSON or SARIF to stdout. A pull request that puts that text into a Compose value can make the Actions runner act on it when the output lands in the job log.","audience":"developers","category":"package","nicknames":[],"who_cares":["github-actions","docker-compose","ci"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Workflow commands in CI job logs could be triggered by pull request content","analyst_note":"","how_to_check":"- Check the installed compose-lint version with `compose-lint --version` or the package manager's list command; `0.31.0` is affected.\n- Look for CI jobs that run compose-lint with `--format json` or `--format sarif` and print stdout to the job log instead of writing a file.\n- Check whether the compose-lint GitHub Action is used instead; the sources say it is not affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["file-output","github-action","not-0.31.0"],"who_is_affected":"Teams that run compose-lint 0.31.0 in GitHub Actions or pre-commit hooks with JSON or SARIF output printed to stdout, so the output reaches the job log. Writing output to a file or using the compose-lint GitHub Action is not affected, and the lint pass or fail result does not change.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00077,"input_tokens":4718,"output_tokens":597,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125122':14A,17A '-2026':13A,16A '0.31.0':29B,92C '0.32.0':198C 'act':64B 'action':24B,35B,62B,133C,176C 'affect':179C 'chang':185C 'ci':18B 'command':6A,38B,102C 'commit':150C 'compos':2A,21B,27B,57B,76C,81C,94C,128C,173C 'compose-lint':1A,26B,75C,93C,172C 'cve':12A,15A 'danger':86C 'deploy':89C 'docker':20B,80C,153C 'docker-compos':19B 'escap':32B 'even':137C 'fail':190C 'file':168C 'fix':195C 'flaw':182C 'format':108C,111C 'github':23B,34B,132C,175C 'github-act':22B 'hook':151C 'identifi':85C 'imag':154C 'insid':104C 'issu':193C 'job':73B,161C 'json':8A,43B,109C,156C 'land':70B 'line':144C 'lint':3A,28B,77C,95C,174C,187C 'linter':83C 'log':74B,162C 'make':60B 'middl':140C 'misconfigur':87C 'name':125C 'open':39B,103C,121C 'output':11A,69B,165C 'packag':25B,147C 'pass':188C 'place':119C 'pre':149C 'pre-commit':148C 'print':42B,155C 'pull':49B,116C 'put':52B 'recogn':135C 'request':50B,117C 'result':191C 'runner':63B,134C 'sanit':98C 'sarif':10A,45B,112C,158C 'secur':82C 'serial':143C 'servic':124C 'stdout':47B,114C 'string':105C 'text':54B 'unsanit':4A 'use':170C 'valu':58B,129C 'version':91C,197C 'workflow':5A,37B,101C 'workflow-command':36B,100C 'write':163C 'written':106C","nicknames":[],"mitigations":[],"who_affected":"Teams that run compose-lint 0.31.0 in GitHub Actions or pre-commit hooks with JSON or SARIF output printed to stdout, so the output reaches the job log. Writing output to a file or using the compose-lint GitHub Action is not affected, and the lint pass or fail result does not change.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","dockercompose","githubactions","low","package"],"campaign_type":null,"search_a":"'-125122':14A,17A '-2026':13A,16A 'command':6A 'compos':2A 'compose-lint':1A 'cve':12A,15A 'json':8A 'lint':3A 'output':11A 'sarif':10A 'unsanit':4A 'workflow':5A","search_b":"'0.31.0':29B 'act':64B 'action':24B,35B,62B 'ci':18B 'command':38B 'compos':21B,27B,57B 'compose-lint':26B 'docker':20B 'docker-compos':19B 'escap':32B 'github':23B,34B 'github-act':22B 'job':73B 'json':43B 'land':70B 'lint':28B 'log':74B 'make':60B 'open':39B 'output':69B 'packag':25B 'print':42B 'pull':49B 'put':52B 'request':50B 'runner':63B 'sarif':45B 'stdout':47B 'text':54B 'valu':58B 'workflow':37B 'workflow-command':36B","search_c":"'0.31.0':92C '0.32.0':198C 'action':133C,176C 'affect':179C 'chang':185C 'command':102C 'commit':150C 'compos':76C,81C,94C,128C,173C 'compose-lint':75C,93C,172C 'danger':86C 'deploy':89C 'docker':80C,153C 'even':137C 'fail':190C 'file':168C 'fix':195C 'flaw':182C 'format':108C,111C 'github':132C,175C 'hook':151C 'identifi':85C 'imag':154C 'insid':104C 'issu':193C 'job':161C 'json':109C,156C 'line':144C 'lint':77C,95C,174C,187C 'linter':83C 'log':162C 'middl':140C 'misconfigur':87C 'name':125C 'open':103C,121C 'output':165C 'packag':147C 'pass':188C 'place':119C 'pre':149C 'pre-commit':148C 'print':155C 'pull':116C 'recogn':135C 'request':117C 'result':191C 'runner':134C 'sanit':98C 'sarif':112C,158C 'secur':82C 'serial':143C 'servic':124C 'stdout':114C 'string':105C 'use':170C 'valu':129C 'version':91C,197C 'workflow':101C 'workflow-command':100C 'write':163C 'written':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:27:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125122","severity":null,"published_at":"2026-11-10T17:17:26+00:00","modified_at":"2026-11-10T17:17:26+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","fetched_at":"2026-11-10T17:22:41+00:00","note":null}],"documents":[{"id":116493,"url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108802,"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116498,"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T01:27:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}