Docker Compose Security Linter Vulnerability in Compose-Lint by tmatens

CVE-2026-125123

What is CVE-2026-125123?

The compose-lint tool, designed for auditing Docker Compose files, has a security flaw in version 0.31.0 related to how it handles repository paths. When users pass paths without a preceding '--' separator, unsanitized output could inject commands into the job logs when processed by CI tools like GitHub Actions. This situation creates a potential for command injection, which could be exploited if misconfigured arguments are provided. It is crucial for users to upgrade to version 0.32.0 or apply recommended mitigation strategies to ensure their deployments remain secure.

References