{"id":"GHSA-xcf7-88g6-7xr8","summary":" compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks ","details":"### Impact\n\nIn Action tags v0.30.0 and v0.31.0, when `sarif-file:` names a file in a subdirectory that can't be created, the Action prints the directory's resolved path in an error message. In v0.31.0 that message is outside the window in which the Action turns command processing off, and v0.30.0 has no such window. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nOnly the Action is affected, and only when `sarif-file:` points into a subdirectory. The documented setup, `sarif-file: results.sarif` at the repository root, is not affected. The `compose-lint` package, the pre-commit hook and the Docker image do not print this message.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n### Patches\n\nFixed in 0.32.0. The SARIF-directory error names the `sarif-file:` input as written.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- Keep `sarif-file` at the workspace root, for example `sarif-file: results.sarif`.\n\n### Reproduction\n\nOn a GitHub-hosted runner (runner 2.337.0), the Action at v0.31.0 with `sarif-file: out/reports/results.sarif`, where `out` is a committed symlink to a directory named `d\\n::warning::X` that contains a regular file `reports`, creates an annotation. With `sarif-file` at the repository root it creates none.","aliases":["CVE-2026-125125"],"modified":"2026-11-10T22:00:04.231598969Z","published":"2026-11-10T21:50:54Z","database_specific":{"github_reviewed_at":"2026-11-10T21:50:54Z","nvd_published_at":"2026-11-10T17:17:27Z","cwe_ids":["CWE-117","CWE-150"],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125125"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"affected":[{"package":{"name":"tmatens/compose-lint","ecosystem":"GitHub Actions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.30.0"},{"fixed":"0.32.0"}]},{"type":"GIT","repo":"https://github.com/tmatens/compose-lint","events":[{"introduced":"adf00708734b772686337b69831c8e3912fa0ed4"},{"fixed":"2d42617e4c6416f797bbfc6a057950131fa02df3"}]}],"versions":["v0.31.0","v0.30.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.31.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xcf7-88g6-7xr8/GHSA-xcf7-88g6-7xr8.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}