Docker Compose Linter Vulnerability in Compose-Lint by tmatens
CVE-2026-125124

2.3LOW

Key Information:

Vendor

Tmatens

Status
Compose-lint
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125124?

The compose-lint tool, which acts as a security linter for Docker Compose files, has a security issue in version 0.31.0 that fails to sanitize certain logging commands. This vulnerability allows attackers to introduce the Azure Pipelines logging-command opener in any output path. Consequently, malicious output generated from a Compose value can trigger logging commands within Azure Pipelines job logs. While this issue does not appear in GitHub Actions nor in earlier versions of compose-lint, it is essential for users of version 0.31.0 to upgrade to version 0.32.0 for resolution.

Affected Version(s)

compose-lint = 0.31.0

References

https://github.com/tmatens/compose-lint/security/advisori...
x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945
x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/542e63126f...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.