{"id":"CVE-2026-125125","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-125125","summary":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints…","details":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.","published":"2026-11-10T17:17:27.053","modified":"2026-11-10T17:17:27.053","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688","label":"tmatens/compose-lint@542e631"},"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-10T17:17:27.053"}}