PT-2026-141817
CVE-2026-125125
·
Published
2026-11-10
·
Updated
2026-11-10
Description by
CVSS 4.0
2.3
LowMetricsAV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
compose-lint versions 0.30.0 through 0.31.0
Description
The compose-lint GitHub Action fails to effectively suppress commands when printing the resolved directory path of a failed
sarif-file subdirectory creation. An attacker can use a pull request to commit a symlink pointing to a directory containing a newline character followed by a workflow command. When the CI runs, the resulting error message can trigger the execution of these commands in the job log, allowing for the creation of annotations or the folding and hiding of log sections. This issue only affects the Action when the sarif-file parameter points to a subdirectory; it does not affect the compose-lint package, the pre-commit hook, the Docker image, or configurations where the SARIF file is located at the workspace root.Recommendations
Update to version 0.32.0 or later.
Keep the
sarif-file at the workspace root, such as sarif-file: results.sarif. Found an issue in the description? Have something to add? Feel free to write us 👾