CVE-2026-125123

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0.

• CWE-117
• CWE-150

• https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688
• https://github.com/tmatens/compose-lint/pull/945
• https://github.com/tmatens/compose-lint/releases/tag/v0.32.0
• https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125113The XRootD project provides a high-performance, fault-tolera…5.3
• CVE-2026-125115Novu provides an API for sending notifications through multi…6.8
• CVE-2026-125117Mongoose is a MongoDB object modeling tool designed to work …8.2
• CVE-2026-12512The Quotes llama WordPress plugin before 3.1.6 does not prop…8.6
• CVE-2026-125121compose-lint is a Docker Compose security linter that identi…5.3
• CVE-2026-125122compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125124compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-125125compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-12513The Shared Files WordPress plugin before 1.7.67, shared-fil…6.8
• CVE-2026-125134Use after free in Windows Function Discovery Resource Public…7.5
• CVE-2026-125135Out-of-bounds read in HID Parser Library allows an unauthori…6.8
• CVE-2026-125136Heap-based buffer overflow in Windows Network Connected Devi…8.8