GHSA-8v59-qmwv-4p6q

Source

https://github.com/advisories/GHSA-8v59-qmwv-4p6q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8v59-qmwv-4p6q

Aliases

CVE-2026-125123

Published

2026-11-10T21:58:53Z

Modified

2026-11-10T22:15:03Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages

Details

Impact

0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in compose-lint's own output, but not in the argument parser's error messages. When a repository path reaches compose-lint's arguments without a -- before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.

A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.

Affected setups pass repository paths to compose-lint without a -- before them: the pre-commit hook when args: is set without the documented trailing --, or the compose-lint package or Docker image called that way in a workflow. The pre-commit hook's default configuration passes -- and is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.

Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.

Docker image. composelint/compose-lint tag 0.31.0 and the matching minor tag are affected, as was latest while it pointed to 0.31.0.

Releases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.

Patches

Fixed in 0.32.0. The argument parser's messages go through the same sanitizer as the rest of compose-lint's output.

Workarounds

Upgrade to 0.32.0 or later.
End the pre-commit hook's args: with --, and put -- before file paths when calling compose-lint directly.
On GitHub Actions, use the tmatens/compose-lint Action, or bracket the compose-lint step with ::stop-commands::<random token> and ::<token>::, as the Action does.

Reproduction

On compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), compose-lint '--##[warning]X/compose.yml' with no -- creates an annotation. The same path after -- creates none. The composelint/compose-lint:0.31.0 image produces byte-identical output to the package.

Database specific

{
    "cwe_ids": [
        "CWE-117",
        "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-10T21:58:53Z",
    "nvd_published_at": "2026-11-10T17:17:26Z",
    "severity": "LOW"
}

References

Affected packages

PyPI / compose-lint

Package

Name: compose-lint; View open source insights on deps.dev
Purl: pkg:pypi/compose-lint

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.31.0

Fixed

0.32.0

Affected versions

0.*

0.31.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json"