{"affected":[{"product":"compose-lint","source":"CNA: GitHub_M","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.30.0, < 0.32.0"}]}],"cveId":"CVE-2026-125125","cwes":["CWE-117","CWE-150"],"description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","version":"4.0"},{"score":2.3,"severity":"low","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794331047053,"publishedAt":1794329755117,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/pull/945"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/pull/945"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"}],"remediation":[],"revision":"ca11d14d5ed656ad23f23d368a0f5b59a63312286f78a92f889437681c1de80a","sources":[{"modifiedAt":1794329755117,"name":"CNA: GitHub_M","retrievedAt":1794330596169,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125125"},{"modifiedAt":1794331047053,"name":"NVD","retrievedAt":1794336294941,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125125"}],"ssvc":null,"status":"published","title":"compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message","updatedAt":1794336294941}