GHSA-xcf7-88g6-7xr8

Source

https://github.com/advisories/GHSA-xcf7-88g6-7xr8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xcf7-88g6-7xr8/GHSA-xcf7-88g6-7xr8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xcf7-88g6-7xr8

Aliases

CVE-2026-125125

Published

2026-11-10T21:50:54Z

Modified

2026-11-10T22:00:04Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks

Details

Impact

In Action tags v0.30.0 and v0.31.0, when sarif-file: names a file in a subdirectory that can't be created, the Action prints the directory's resolved path in an error message. In v0.31.0 that message is outside the window in which the Action turns command processing off, and v0.30.0 has no such window. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command.

A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.

Only the Action is affected, and only when sarif-file: points into a subdirectory. The documented setup, sarif-file: results.sarif at the repository root, is not affected. The compose-lint package, the pre-commit hook and the Docker image do not print this message.

Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.

Patches

Fixed in 0.32.0. The SARIF-directory error names the sarif-file: input as written.

Workarounds

Upgrade to 0.32.0 or later.
Keep sarif-file at the workspace root, for example sarif-file: results.sarif.

Reproduction

On a GitHub-hosted runner (runner 2.337.0), the Action at v0.31.0 with sarif-file: out/reports/results.sarif, where out is a committed symlink to a directory named d\n::warning::X that contains a regular file reports, creates an annotation. With sarif-file at the repository root it creates none.

Database specific

{
    "cwe_ids": [
        "CWE-117",
        "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-10T21:50:54Z",
    "nvd_published_at": "2026-11-10T17:17:27Z",
    "severity": "LOW"
}

References

Affected packages

GitHub Actions / tmatens/compose-lint

Package

Name: tmatens/compose-lint

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.30.0

Fixed

0.32.0

Type: GIT
Repo: https://github.com/tmatens/compose-lint
Events: Introduced

adf00708734b772686337b69831c8e3912fa0ed4

Fixed

2d42617e4c6416f797bbfc6a057950131fa02df3

Affected versions

v0.*

v0.30.0

v0.31.0

Database specific

last_known_affected_version_range

"<= 0.31.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xcf7-88g6-7xr8/GHSA-xcf7-88g6-7xr8.json"