---
id: "CVE-2026-125122"
page: "https://infrastack.ai/live/CVE-2026-125122"
kind: "vulnerability"
aliases: ["CVE-2026-125122"]
title: "compose-lint: unsanitized workflow commands in JSON and SARIF output"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "docker-compose", "github-actions", "package"]
not_affected_if: ["file-output", "github-action", "not-0.31.0"]
published_at: "2026-11-10T17:17:26+00:00"
first_seen_at: "2026-11-10T17:22:41+00:00"
updated_at: "2026-11-10T17:25:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125122", "first_seen_at": "2026-11-10T17:22:41+00:00"}]
exploit_sources: []
---

# compose-lint: unsanitized workflow commands in JSON and SARIF output

Link for people: https://infrastack.ai/live/CVE-2026-125122 (this .md is for agents)

compose-lint 0.31.0 does not escape the GitHub Actions workflow-command opener when it prints JSON or SARIF to stdout. A pull request that puts that text into a Compose value can make the Actions runner act on it when the output lands in the job log.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed compose-lint version with `compose-lint --version` or the package manager's list command; `0.31.0` is affected.
- Look for CI jobs that run compose-lint with `--format json` or `--format sarif` and print stdout to the job log instead of writing a file.
- Check whether the compose-lint GitHub Action is used instead; the sources say it is not affected.

## Fix

- compose-lint: move to `0.32.0`

## Timeline

- 2026-11-10T17:22:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125122

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4
- [fix] Patch: github.com https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688
- [fix] Release notes: github.com https://github.com/tmatens/compose-lint/releases/tag/v0.32.0

## From the sources

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_