{"id":"GHSA-8v59-qmwv-4p6q","summary":"compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages ","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in compose-lint's own output, but not in the argument parser's error messages. When a repository path reaches compose-lint's arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups pass repository paths to compose-lint without a `--` before them: the pre-commit hook when `args:` is set without the documented trailing `--`, or the `compose-lint` package or Docker image called that way in a workflow. The pre-commit hook's default configuration passes `--` and is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.\n\n### Patches\n\nFixed in 0.32.0. The argument parser's messages go through the same sanitizer as the rest of compose-lint's output.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- End the pre-commit hook's `args:` with `--`, and put `--` before file paths when calling compose-lint directly.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::\u003crandom token\u003e` and `::\u003ctoken\u003e::`, as the Action does.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), `compose-lint '--##[warning]X/compose.yml'` with no `--` creates an annotation. The same path after `--` creates none. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","aliases":["CVE-2026-125123"],"modified":"2026-11-10T22:15:03.405244565Z","published":"2026-11-10T21:58:53Z","database_specific":{"github_reviewed_at":"2026-11-10T21:58:53Z","nvd_published_at":"2026-11-10T17:17:26Z","cwe_ids":["CWE-117","CWE-150"],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125123"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}