CVE-2026-125123
compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages
Published Nov 10, 2026
CVSS 4.0 · 2.3 Low
EPSS < 1%
KEV · Not listed
Description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| tmatens | compose-lint | affected |
|
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-8v59-qmwv-4p6q | compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages |
Metrics
Attack Vector Network
Attack Complexity Low
Privileges Required None
Attack Requirements Present
User Interaction Passive
Vulnerable System Confidentiality Impact None
Vulnerable System Integrity Impact Low
Vulnerable System Availability Impact None
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact Low
Subsequent System Availability Impact None
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.397% probability within 30 days)
Exploitation none
Automatable no
Technical Impact partial
References
History
Nov 12, 2026 1:30 AM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Nov 10, 2026 5:00 PM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0. | |
| Title | compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages | |
| Weaknesses | CWE-117 CWE-150 |
|
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
