Docker Compose Security Linter Vulnerability in Compose-Lint by Tmatens

CVE-2026-125125

What is CVE-2026-125125?

The compose-lint security linter, utilized for identifying dangerous configurations in Docker Compose files, has a vulnerability in versions 0.30.0 and 0.31.0. This issue arises when the GitHub Action fails to suppress commands during a failed sarif-file subdirectory creation, enabling the potential for command injection via symlink manipulation. Users can inadvertently expose sensitive information in the job logs if their configuration uses a subdirectory for SARIF files. The vulnerability has been addressed in version 0.32.0, which rectifies the command suppression flaw.

References