CVE-2026-125125
compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.
| CWE | CWE-117 CWE-150 |
| Vendor | tmatens |
| Product | compose-lint |
| Published | Nov 10, 2026 |
| Last Updated | Nov 10, 2026 |
Get instant alerts for tmatens compose-lint
Be the first to know when new unknown vulnerabilities affecting tmatens compose-lint are published — delivered to Slack, Telegram or Discord.