{"id":"GHSA-hr4h-4c45-v4q4","summary":"compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. `--format json` and `--format sarif` output never passed through that fix, so `##[` inside a service name or other value reaches the log intact when the output is printed to stdout rather than written to a file. The runner acts on `##[` in the middle of a line, so the JSON layout does not prevent it.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups print JSON or SARIF output to a CI log from the `compose-lint` package, the pre-commit hook or the Docker image. Writing that output to a file, which SARIF upload requires, is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.\n\n### Patches\n\nFixed in 0.32.0. JSON and SARIF on stdout escape `##[` inside strings as `\\u005b`, which decodes to the same data.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- Write `--format json` and `--format sarif` output to a file rather than the log.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::\u003crandom token\u003e` and `::\u003ctoken\u003e::`, as the Action does.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), a service named `a##[warning]X`, linted with `--format json` or `--format sarif` to stdout, creates annotations. The same file linted with the text report creates none. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","aliases":["CVE-2026-125122"],"modified":"2026-11-10T22:00:03.806318604Z","published":"2026-11-10T21:40:50Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:40:50Z","nvd_published_at":"2026-11-10T17:17:26Z","cwe_ids":["CWE-117","CWE-150"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125122"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hr4h-4c45-v4q4/GHSA-hr4h-4c45-v4q4.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}