{"affected":[{"product":"compose-lint","source":"CNA: GitHub_M","vendor":"tmatens","versions":[{"status":"affected","version":"< 0.31.0"}]}],"cveId":"CVE-2026-123369","cwes":["CWE-117","CWE-150"],"description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","version":"4.0"},{"score":5.3,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794266235217,"publishedAt":1794245545031,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/pull/918"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/pull/918"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"}],"remediation":[],"revision":"fd6ff06ce6c2257e4e075849b50d9fbf3bde778780700122c99f5a5db4a11c2a","sources":[{"modifiedAt":1794264925407,"name":"CNA: GitHub_M","retrievedAt":1794265744300,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123369"},{"modifiedAt":1794266235217,"name":"NVD","retrievedAt":1794269944367,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123369"}],"ssvc":{"assessedAt":1794264726368,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action","updatedAt":1794269944367}