compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:NAssessment vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:NSeverity
low2.3CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Package fixes recorded
Fix versions are recorded for 1 of 1 mapped packages. Check each release branch and any separate product guidance.
What this means
The compose-lint package, version 0.31.0, has a vulnerability where text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout. An attacker with access to a pull request can create annotations or issue other commands. The vulnerability is mitigated by upgrading to version 0.32.0 or later, or writing output to a file instead of the log.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Attack conditions
Writing that output to a file, which SARIF upload requires, is not affected.
Excerpt from the original source description below.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
tmatens · GitHub_M
compose-lint
1 range
tmatens · GitHub_M
compose-lint
Compare with this publisher’s ranges. This does not inspect your installation.
affected
= 0.31.0
Other versions: unknown
Packages
Compare each installed version with the publisher’s affected ranges. Where a fix is recorded, choose the appropriate release branch and test compatibility before upgrading.
| Affected range | Recorded fix |
|---|---|
| From 0.31.0 before 0.32.0Ecosystem versions | 0.32.0 |
Version evidence: OSV · GHSA-hr4h-4c45-v4q4
View original version evidence (1 explicit versions)
What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
Use the recorded fix for your release branch. Review the publisher’s instructions and test compatibility before upgrading.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
Impact
0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. --format json and --format sarif output never passed through that fix, so ##[ inside a service name or other value reaches the log intact when the output is printed to stdout rather than written to a file. The runner acts on ##[ in the middle of a line, so the JSON layout does not prevent it.
A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.
Affected setups print JSON or SARIF output to a CI log from the compose-lint package, the pre-commit hook or the Docker image. Writing that output to a file, which SARIF upload requires, is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.
Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.
Docker image. composelint/compose-lint tag 0.31.0 and the matching minor tag are affected, as was latest while it pointed to 0.31.0.
Releases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.
Patches
Fixed in 0.32.0. JSON and SARIF on stdout escape ##[ inside strings as \u005b, which decodes to the same data.
Workarounds
- Upgrade to 0.32.0 or later.
- Write
--format jsonand--format sarifoutput to a file rather than the log. - On GitHub Actions, use the
tmatens/compose-lintAction, or bracket the compose-lint step with::stop-commands::<random token>and::<token>::, as the Action does.
Reproduction
On compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), a service named a##[warning]X, linted with --format json or --format sarif to stdout, creates annotations. The same file linted with the text report creates none. The composelint/compose-lint:0.31.0 image produces byte-identical output to the package.
References
6 sourcesInside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-125122View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.