---
id: "CVE-2026-125124"
page: "https://infrastack.ai/live/CVE-2026-125124"
kind: "vulnerability"
aliases: ["CVE-2026-125124"]
title: "compose-lint: crafted Compose values can inject Azure Pipelines logging commands"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "compose-lint", "fixed": [], "affected": "", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["azure-pipelines", "compose-lint", "docker-compose", "package"]
not_affected_if: ["github-actions-only", "not-azure-pipelines", "versions-before-0.31.0"]
published_at: "2026-11-10T17:17:26+00:00"
first_seen_at: "2026-11-10T17:22:41+00:00"
updated_at: "2026-11-10T17:25:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125124", "first_seen_at": "2026-11-10T17:22:41+00:00"}]
exploit_sources: []
---

# compose-lint: crafted Compose values can inject Azure Pipelines logging commands

Link for people: https://infrastack.ai/live/CVE-2026-125124 (this .md is for agents)

compose-lint 0.31.0 does not neutralize the Azure Pipelines ##vso[ logging-command opener in its output, so a pull request that places it in a Compose value or file name can make the linter's printed output issue logging commands in an Azure Pipelines job log. The advisory notes the maintainer did not reproduce it on an Azure Pipelines agent.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:compose-lint affected range not listed fixed no fixed version listed

## How to check

- Check the installed compose-lint version, for example with `compose-lint --version` or the lockfile entry, and see whether it is `0.31.0`.
- If a pipeline runs compose-lint on Azure Pipelines, look for it in the pipeline YAML or pre-commit config.
- The GitHub Action is not affected according to the advisory.

## Fix

- compose-lint: move to `0.32.0`

## Timeline

- 2026-11-10T17:22:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125124

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tmatens/compose-lint/security/advisories/GHSA-m4xg-839g-24cv
- [fix] Patch: github.com https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688
- [fix] Release notes: github.com https://github.com/tmatens/compose-lint/releases/tag/v0.32.0

## From the sources

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place that opener in a Compose value or file name, allowing output from the package, pre-commit hook, or Docker image to issue logging commands when printed to an Azure Pipelines job log. The maintainer did not reproduce the behavior on an Azure Pipelines agent. The GitHub Action is not affected because it runs only on GitHub Actions, and releases before 0.31.0 are outside this advisory because they did not claim Azure Pipelines coverage. This issue is fixed in version 0.32.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_