Docker Compose Security Linter Vulnerability Detected in Compose-lint by tmatens

CVE-2026-125121

What is CVE-2026-125121?

A vulnerability exists in compose-lint, a security linter for Docker Compose, in version 0.31.0. It improperly handles Unicode whitespace, allowing untrusted Compose values or paths to be interpreted as workflow commands in CI environments. As a result, sensitive information may be exposed in text reports, diagnostics, and guidance. This issue is addressed in version 0.32.0, which enhances security by escaping GitHub Actions workflow-command openers more effectively.

References