CVE-2026-125123

Name of the Vulnerable Software and Affected Versions compose-lint version 0.31.0

Description The argument parser in compose-lint writes rejected repository paths to stderr without using an output sanitizer when a path is provided without a preceding -- separator. An attacker can supply a path containing workflow-command syntax and a carriage return, which allows the command to be positioned at the start of a new line. When processed by a GitHub Actions runner, this enables the issuance of commands in the job log, such as creating annotations or folding and hiding parts of the log. This can occur via a pull request when the package, Docker image, or a pre-commit hook with misconfigured arguments is used.

Recommendations Update compose-lint to version 0.32.0. End the pre-commit hook args: with --. Place -- before file paths when calling compose-lint directly. On GitHub Actions, use the tmatens/compose-lint Action or bracket the compose-lint step with ::stop-commands::<random token> and ::<token>::.