{"id":"CVE-2026-125125","kind":"vulnerability","aliases":["CVE-2026-125125"],"related":[],"title":"compose-lint GitHub Action: pull request can inject workflow commands into job logs","description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.","summary":"The compose-lint GitHub Action prints a directory path when creating a SARIF subdirectory fails, and a crafted symlink with a newline in its name can make that output issue workflow commands in the CI job log. An attacker who can open a pull request can use this to run workflow commands inside the CI job log.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","docker-compose","github-actions","package"],"not_affected_if":["action-version-0.32.0-or-later","no-compose-lint-action","workspace-root-sarif"],"how_to_check":"- Check whether a workflow uses the `compose-lint` GitHub Action with a `sarif-file` value that points into a subdirectory.\n- Check the Action version in the workflow file; versions `0.30.0` through `0.31.x` are affected.","fix":"- compose-lint GitHub Action: move to `0.32.0`","status":"open","published_at":"2026-11-10T17:17:27+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","triaged_at":"2026-11-10T17:25:46+00:00","updated_at":"2026-11-10T17:25:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T17:25:46Z","model":"claude-haiku-5-5","output":{"fix":"- compose-lint GitHub Action: move to `0.32.0`","reach":"internet","title":"compose-lint GitHub Action: pull request can inject workflow commands into job logs","impact":"medium","summary":"The compose-lint GitHub Action prints a directory path when creating a SARIF subdirectory fails, and a crafted symlink with a newline in its name can make that output issue workflow commands in the CI job log. An attacker who can open a pull request can use this to run workflow commands inside the CI job log.","audience":"developers","category":"package","nicknames":[],"who_cares":["github-actions","docker-compose","ci"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Workflow commands run in the CI job log via crafted pull request.","analyst_note":"","how_to_check":"- Check whether a workflow uses the `compose-lint` GitHub Action with a `sarif-file` value that points into a subdirectory.\n- Check the Action version in the workflow file; versions `0.30.0` through `0.31.x` are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["workspace-root-sarif","action-version-0.32.0-or-later","no-compose-lint-action"],"who_is_affected":"Only repositories whose CI runs the compose-lint GitHub Action with sarif-file pointing into a subdirectory are exposed. Workspace-root SARIF files, the compose-lint package, the pre-commit hook and the Docker image do not print this message and can be skipped.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000767,"input_tokens":4768,"output_tokens":580,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125125':17A,20A '-2026':16A,19A '0.30.0':104C,130C '0.31.0':139C '0.32.0':106C,230C 'action':5A,27B,34B,112C,188C 'affect':198C 'attack':68B 'caus':173C 'ci':21B,64B,84B 'command':11A,61B,81B,127C,135C,147C,172C,181C 'commit':155C,213C 'compos':2A,24B,31B,88C,93C,109C,207C 'compose-lint':1A,30B,87C,108C,206C 'contain':165C 'craft':47B 'creat':40B 'creation':124C 'cve':15A,18A 'danger':98C 'deploy':101C 'directori':37B,116C,162C,177C 'docker':23B,92C,217C 'docker-compos':22B 'effect':126C 'error':142C,178C 'expos':221C 'fail':44B,119C 'file':122C,192C,204C 'fix':227C 'follow':168C 'github':4A,26B,33B,111C 'github-act':25B 'hook':214C 'identifi':97C 'imag':218C 'inject':9A 'insid':82B 'issu':59B,180C,225C 'job':13A,65B,85B,184C 'lint':3A,32B,89C,110C,208C 'linter':95C 'log':14A,66B,86B,185C 'make':56B 'messag':223C 'misconfigur':99C 'name':54B,164C 'newlin':51B,167C 'open':71B 'output':58B 'outsid':143C 'packag':28B,209C 'path':38B,159C 'place':153C 'point':193C 'pre':212C 'pre-commit':211C 'print':35B,113C,140C 'pull':6A,73B,150C 'request':7A,74B,151C 'resolv':115C 'root':202C 'run':79B 'sarif':42B,121C,176C,191C,203C 'sarif-directori':175C 'sarif-fil':120C,190C 'secur':94C 'stop':134C,146C 'stop-command':133C,145C 'subdirectori':43B,123C,196C 'suppress':128C 'symlink':48B,156C 'use':76B 'version':103C,129C,138C,229C 'whose':163C 'window':136C,148C 'without':125C 'workflow':10A,60B,80B,171C 'workspac':201C 'workspace-root':200C","nicknames":[],"mitigations":[],"who_affected":"Only repositories whose CI runs the compose-lint GitHub Action with sarif-file pointing into a subdirectory are exposed. Workspace-root SARIF files, the compose-lint package, the pre-commit hook and the Docker image do not print this message and can be skipped.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","dockercompose","githubactions","low","package"],"campaign_type":null,"search_a":"'-125125':17A,20A '-2026':16A,19A 'action':5A 'command':11A 'compos':2A 'compose-lint':1A 'cve':15A,18A 'github':4A 'inject':9A 'job':13A 'lint':3A 'log':14A 'pull':6A 'request':7A 'workflow':10A","search_b":"'action':27B,34B 'attack':68B 'ci':21B,64B,84B 'command':61B,81B 'compos':24B,31B 'compose-lint':30B 'craft':47B 'creat':40B 'directori':37B 'docker':23B 'docker-compos':22B 'fail':44B 'github':26B,33B 'github-act':25B 'insid':82B 'issu':59B 'job':65B,85B 'lint':32B 'log':66B,86B 'make':56B 'name':54B 'newlin':51B 'open':71B 'output':58B 'packag':28B 'path':38B 'print':35B 'pull':73B 'request':74B 'run':79B 'sarif':42B 'subdirectori':43B 'symlink':48B 'use':76B 'workflow':60B,80B","search_c":"'0.30.0':104C,130C '0.31.0':139C '0.32.0':106C,230C 'action':112C,188C 'affect':198C 'caus':173C 'command':127C,135C,147C,172C,181C 'commit':155C,213C 'compos':88C,93C,109C,207C 'compose-lint':87C,108C,206C 'contain':165C 'creation':124C 'danger':98C 'deploy':101C 'directori':116C,162C,177C 'docker':92C,217C 'effect':126C 'error':142C,178C 'expos':221C 'fail':119C 'file':122C,192C,204C 'fix':227C 'follow':168C 'github':111C 'hook':214C 'identifi':97C 'imag':218C 'issu':180C,225C 'job':184C 'lint':89C,110C,208C 'linter':95C 'log':185C 'messag':223C 'misconfigur':99C 'name':164C 'newlin':167C 'outsid':143C 'packag':209C 'path':159C 'place':153C 'point':193C 'pre':212C 'pre-commit':211C 'print':113C,140C 'pull':150C 'request':151C 'resolv':115C 'root':202C 'sarif':121C,176C,191C,203C 'sarif-directori':175C 'sarif-fil':120C,190C 'secur':94C 'stop':134C,146C 'stop-command':133C,145C 'subdirectori':123C,196C 'suppress':128C 'symlink':156C 'version':103C,129C,138C,229C 'whose':163C 'window':136C,148C 'without':125C 'workflow':171C 'workspac':201C 'workspace-root':200C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:27:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125125","severity":null,"published_at":"2026-11-10T17:17:27+00:00","modified_at":"2026-11-10T17:17:27+00:00","first_seen_at":"2026-11-10T17:22:41+00:00","fetched_at":"2026-11-10T17:22:41+00:00","note":null}],"documents":[{"id":116493,"url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108802,"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116507,"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T01:27:16+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}