{"id":"CVE-2026-125124","kind":"vulnerability","aliases":["CVE-2026-125124"],"related":[],"title":"compose-lint: crafted Compose values can inject Azure Pipelines logging commands","description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place that opener in a Compose value or file name, allowing output from the package, pre-commit hook, or Docker image to issue logging commands when printed to an Azure Pipelines job log. The maintainer did not reproduce the behavior on an Azure Pipelines agent. The GitHub Action is not affected because it runs only on GitHub Actions, and releases before 0.31.0 are outside this advisory because they did not claim Azure Pipelines coverage. This issue is fixed in version 0.32.0.","summary":"compose-lint 0.31.0 does not neutralize the Azure Pipelines ##vso[ logging-command opener in its output, so a pull request that places it in a Compose value or file name can make the linter's printed output issue logging commands in an Azure Pipelines job log. The advisory notes the maintainer did not reproduce it on an Azure Pipelines agent.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"compose-lint","fixed":[],"affected":"","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["azure-pipelines","compose-lint","docker-compose","package"],"not_affected_if":["github-actions-only","not-azure-pipelines","versions-before-0.31.0"],"how_to_check":"- Check the installed compose-lint version, for example with `compose-lint --version` or the lockfile entry, and see whether it is `0.31.0`.\n- If a pipeline runs compose-lint on Azure Pipelines, look for it in the pipeline YAML or pre-commit config.\n- The GitHub Action is not affected according to the advisory.","fix":"- compose-lint: move to `0.32.0`","status":"open","published_at":"2026-11-10T17:17:26+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","triaged_at":"2026-11-10T17:25:54+00:00","updated_at":"2026-11-10T17:25:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T17:25:54Z","model":"claude-haiku-5-5","output":{"fix":"- compose-lint: move to `0.32.0`","reach":"network","title":"compose-lint: crafted Compose values can inject Azure Pipelines logging commands","impact":"low","summary":"compose-lint 0.31.0 does not neutralize the Azure Pipelines ##vso[ logging-command opener in its output, so a pull request that places it in a Compose value or file name can make the linter's printed output issue logging commands in an Azure Pipelines job log. The advisory notes the maintainer did not reproduce it on an Azure Pipelines agent.","audience":"developers","category":"package","nicknames":[],"who_cares":["compose-lint","azure-pipelines","docker-compose"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Pipeline job log output issues logging commands","analyst_note":"","how_to_check":"- Check the installed compose-lint version, for example with `compose-lint --version` or the lockfile entry, and see whether it is `0.31.0`.\n- If a pipeline runs compose-lint on Azure Pipelines, look for it in the pipeline YAML or pre-commit config.\n- The GitHub Action is not affected according to the advisory.","plain_action":"","product_name":"compose-lint","needs_analyst":false,"not_affected_if":["github-actions-only","versions-before-0.31.0","not-azure-pipelines"],"who_is_affected":"Teams that run compose-lint 0.31.0 in an Azure Pipelines job, through the package, pre-commit hook or Docker image, on Compose files that can come from pull requests. The GitHub Action is stated as not affected, and releases before 0.31.0 are stated as outside this advisory.","user_interaction":"yes","product_ecosystem":"pypi","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000793,"input_tokens":4740,"output_tokens":638,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125124':15A,18A '-2026':14A,17A '0.31.0':35B,111C,196C '0.32.0':215C 'action':182C,192C 'advisori':81B,200C 'affect':185C 'agent':93B,179C 'allow':144C 'azur':9A,23B,40B,76B,91B,119C,164C,177C,206C 'azure-pipelin':22B 'behavior':174C 'claim':205C 'command':12A,45B,73B,124C,159C 'commit':151C 'compos':2A,5A,26B,30B,33B,59B,95C,100C,113C,139C 'compose':20A 'compose-lint':1A,19A,25B,32B,94C,112C 'coverag':208C 'craft':4A 'cve':13A,16A 'danger':105C 'deploy':108C 'docker':29B,99C,154C 'docker-compos':28B 'file':62B,142C 'fix':212C 'github':181C,191C 'hook':152C 'identifi':104C 'imag':155C 'inject':8A 'issu':71B,157C,210C 'job':78B,166C 'lint':3A,21A,27B,34B,96C,114C 'linter':67B,102C 'log':11A,44B,72B,79B,123C,158C,167C 'logging-command':43B,122C 'maintain':84B,169C 'make':65B 'misconfigur':106C 'name':63B,143C 'neutral':38B,117C 'note':82B 'open':46B,125C,136C 'output':49B,70B,128C,145C 'outsid':198C 'packag':31B,148C 'path':129C 'pipelin':10A,24B,41B,77B,92B,120C,165C,178C,207C 'place':55B,134C 'pre':150C 'pre-commit':149C 'print':69B,161C 'pull':52B,131C 'releas':194C 'reproduc':87B,172C 'request':53B,132C 'run':188C 'secur':101C 'valu':6A,60B,140C 'version':110C,214C 'vso':42B,121C","nicknames":[],"mitigations":[],"who_affected":"Teams that run compose-lint 0.31.0 in an Azure Pipelines job, through the package, pre-commit hook or Docker image, on Compose files that can come from pull requests. The GitHub Action is stated as not affected, and releases before 0.31.0 are stated as outside this advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["composelint"],"ptokens":["compose","lint"],"labels":["azurepipelines","composelint","dockercompose","low","package","pypi"],"campaign_type":null,"search_a":"'-125124':15A,18A '-2026':14A,17A 'azur':9A 'command':12A 'compos':2A,5A 'compose':20A 'compose-lint':1A,19A 'craft':4A 'cve':13A,16A 'inject':8A 'lint':3A,21A 'log':11A 'pipelin':10A 'valu':6A","search_b":"'0.31.0':35B 'advisori':81B 'agent':93B 'azur':23B,40B,76B,91B 'azure-pipelin':22B 'command':45B,73B 'compos':26B,30B,33B,59B 'compose-lint':25B,32B 'docker':29B 'docker-compos':28B 'file':62B 'issu':71B 'job':78B 'lint':27B,34B 'linter':67B 'log':44B,72B,79B 'logging-command':43B 'maintain':84B 'make':65B 'name':63B 'neutral':38B 'note':82B 'open':46B 'output':49B,70B 'packag':31B 'pipelin':24B,41B,77B,92B 'place':55B 'print':69B 'pull':52B 'reproduc':87B 'request':53B 'valu':60B 'vso':42B","search_c":"'0.31.0':111C,196C '0.32.0':215C 'action':182C,192C 'advisori':200C 'affect':185C 'agent':179C 'allow':144C 'azur':119C,164C,177C,206C 'behavior':174C 'claim':205C 'command':124C,159C 'commit':151C 'compos':95C,100C,113C,139C 'compose-lint':94C,112C 'coverag':208C 'danger':105C 'deploy':108C 'docker':99C,154C 'file':142C 'fix':212C 'github':181C,191C 'hook':152C 'identifi':104C 'imag':155C 'issu':157C,210C 'job':166C 'lint':96C,114C 'linter':102C 'log':123C,158C,167C 'logging-command':122C 'maintain':169C 'misconfigur':106C 'name':143C 'neutral':117C 'open':125C,136C 'output':128C,145C 'outsid':198C 'packag':148C 'path':129C 'pipelin':120C,165C,178C,207C 'place':134C 'pre':150C 'pre-commit':149C 'print':161C 'pull':131C 'releas':194C 'reproduc':172C 'request':132C 'run':188C 'secur':101C 'valu':140C 'version':110C,214C 'vso':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:27:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125124","severity":null,"published_at":"2026-11-10T17:17:26+00:00","modified_at":"2026-11-10T17:17:26+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","fetched_at":"2026-11-10T17:22:41+00:00","note":null}],"documents":[{"id":116493,"url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108802,"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116504,"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-m4xg-839g-24cv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T01:27:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}