CVE-2026-125122

Name of the Vulnerable Software and Affected Versions compose-lint version 0.31.0

Description When using --format json or --format sarif to print output to stdout, the software fails to sanitize the ##[ workflow-command opener within strings. This allows a pull request to include the opener in a service name or other Compose value, which the GitHub Actions runner then recognizes and executes even when embedded in a serialized line. This can lead to the unauthorized creation of annotations, folding or hiding parts of the job log, or the issuance of other commands accepted by the runner. This issue occurs when the package, pre-commit hook, or Docker image prints output to the CI log, but does not affect the lint pass or fail result.

Recommendations Update compose-lint to version 0.32.0 or later. Write --format json and --format sarif output to a file instead of the log. On GitHub Actions, use the tmatens/compose-lint Action. Bracket the compose-lint step with ::stop-commands::<random token> and ::<token>:: to disable command processing.