---
id: "CVE-2026-125125"
page: "https://infrastack.ai/live/CVE-2026-125125"
kind: "vulnerability"
aliases: ["CVE-2026-125125"]
title: "compose-lint GitHub Action: pull request can inject workflow commands into job logs"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "docker-compose", "github-actions", "package"]
not_affected_if: ["action-version-0.32.0-or-later", "no-compose-lint-action", "workspace-root-sarif"]
published_at: "2026-11-10T17:17:27+00:00"
first_seen_at: "2026-11-10T17:22:41+00:00"
updated_at: "2026-11-10T17:25:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125125", "first_seen_at": "2026-11-10T17:22:41+00:00"}]
exploit_sources: []
---

# compose-lint GitHub Action: pull request can inject workflow commands into job logs

Link for people: https://infrastack.ai/live/CVE-2026-125125 (this .md is for agents)

The compose-lint GitHub Action prints a directory path when creating a SARIF subdirectory fails, and a crafted symlink with a newline in its name can make that output issue workflow commands in the CI job log. An attacker who can open a pull request can use this to run workflow commands inside the CI job log.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether a workflow uses the `compose-lint` GitHub Action with a `sarif-file` value that points into a subdirectory.
- Check the Action version in the workflow file; versions `0.30.0` through `0.31.x` are affected.

## Fix

- compose-lint GitHub Action: move to `0.32.0`

## Timeline

- 2026-11-10T17:22:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125125

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8
- [fix] Patch: github.com https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688
- [fix] Release notes: github.com https://github.com/tmatens/compose-lint/releases/tag/v0.32.0

## From the sources

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_