Security Flaw in Docker Compose Linter Affects Multiple Configurations
CVE-2026-125122

2.3LOW

Key Information:

Vendor

Tmatens

Status
Compose-lint
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125122?

The version 0.31.0 of compose-lint, a tool designed to identify dangerous misconfigurations in Docker Compose files, introduces a security issue where the workflow-command opener is not properly sanitized in JSON or SARIF formatted outputs. This vulnerability allows a malicious pull request to incorporate the opener within service names or other Compose values, which can be interpreted by the GitHub Actions runner even when embedded within serialized output. This flaw is mitigated in version 0.32.0, and users are advised to update to the latest version to ensure secure deployments.

Affected Version(s)

compose-lint = 0.31.0

References

https://github.com/tmatens/compose-lint/security/advisori...
x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945
x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/542e63126f...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.