CVE-2026-125125 · Package
NO FIX YET · SEE WHAT TO DO
The compose-lint GitHub Action prints a directory path when creating a SARIF subdirectory fails, and a crafted symlink with a newline in its name can make that output issue workflow commands in the CI job log. An attacker who can open a pull request can use this to run workflow commands inside the CI job log.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only repositories whose CI runs the compose-lint GitHub Action with sarif-file pointing into a subdirectory are exposed. Workspace-root SARIF files, the compose-lint package, the pre-commit hook and the Docker image do not print this message and can be skipped.
Not affected if action-version-0.32.0-or-later, no-compose-lint-action, workspace-root-sarif
Who cares ci, docker-compose, github-actions
compose-lint GitHub Action with a sarif-file value that points into a subdirectory.0.30.0 through 0.31.x are affected.0.32.0compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.