CVE-2026-125122

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.

• CWE-117
• CWE-150

• https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688
• https://github.com/tmatens/compose-lint/pull/945
• https://github.com/tmatens/compose-lint/releases/tag/v0.32.0
• https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125109Rack is a modular Ruby web server interface. From 3.0 until …4.8
• CVE-2026-12511The AI Engine WordPress plugin before 3.5.5 does not saniti…8.1
• CVE-2026-125113The XRootD project provides a high-performance, fault-tolera…5.3
• CVE-2026-125117Mongoose is a MongoDB object modeling tool designed to work …8.2
• CVE-2026-12512The Quotes llama WordPress plugin before 3.1.6 does not prop…8.6
• CVE-2026-125121compose-lint is a Docker Compose security linter that identi…5.3
• CVE-2026-125123compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125124compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125125compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-12513The Shared Files WordPress plugin before 1.7.67, shared-fil…6.8
• CVE-2026-12514The Shared Files WordPress plugin before 1.7.67, shared-fil…5.3
• CVE-2026-12515A flaw was found in Katello's of Red Hat Satellite. A conten…4.3