{"id":"CVE-2026-125125","summary":"compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message","details":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.","aliases":["GHSA-xcf7-88g6-7xr8"],"modified":"2026-11-12T02:48:31.288549518Z","published":"2026-11-10T16:55:55.117Z","database_specific":{"cwe_ids":["CWE-117","CWE-150"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125125.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125125.json"},{"type":"ADVISORY","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125125"},{"type":"FIX","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"FIX","url":"https://github.com/tmatens/compose-lint/pull/945"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tmatens/compose-lint","events":[{"introduced":"adf00708734b772686337b69831c8e3912fa0ed4"},{"fixed":"2d42617e4c6416f797bbfc6a057950131fa02df3"},{"fixed":"542e63126f795564a65c63887ea0dc558a500688"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0.30.0"},{"fixed":"0.32.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"542e63126f795564a65c63887ea0dc558a500688"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"2d42617e4c6416f797bbfc6a057950131fa02df3"}],"source":"REFERENCES_TAG","original_tag":"v0.32.0"}]}}],"versions":["v0.31.0","v0.30.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125125.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}