COMPOSE-LINT · CVE-2026-125124 · Package
NO FIX YET · SEE WHAT TO DO
compose-lint 0.31.0 does not neutralize the Azure Pipelines ##vso[ logging-command opener in its output, so a pull request that places it in a Compose value or file name can make the linter's printed output issue logging commands in an Azure Pipelines job log. The advisory notes the maintainer did not reproduce it on an Azure Pipelines agent.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run compose-lint 0.31.0 in an Azure Pipelines job, through the package, pre-commit hook or Docker image, on Compose files that can come from pull requests. The GitHub Action is stated as not affected, and releases before 0.31.0 are stated as outside this advisory.
Not affected if github-actions-only, not-azure-pipelines, versions-before-0.31.0
Who cares azure-pipelines, compose-lint, docker-compose
compose-lint --version or the lockfile entry, and see whether it is 0.31.0.0.32.0compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place that opener in a Compose value or file name, allowing output from the package, pre-commit hook, or Docker image to issue logging commands when printed to an Azure Pipelines job log. The maintainer did not reproduce the behavior on an Azure Pipelines agent. The GitHub Action is not affected because it runs only on GitHub Actions, and releases before 0.31.0 are outside this advisory because they did not claim Azure Pipelines coverage. This issue is fixed in version 0.32.0.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.