Answer in brief
CVE-2026-125121 records a Medium severity (CVSS 5.3) vulnerability in compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output. The current sources do not mark it as known exploited. The current feed maps tmatens/compose-lint (generic), tmatens/compose-lint (generic), compose-lint (pip). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps tmatens/compose-lint (generic), tmatens/compose-lint (generic), compose-lint (pip). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| tmatens/compose-lintgeneric | = 0.31.0 | Not reported |
| tmatens/compose-lintgeneric | >=0.31.0 <0.32.0 | 0.32.0 |
| compose-lintpip | >=0.31.0,<0.32.0 | 0.32.0 |
Published upstream
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 10, 2026
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.
Quoted source text, attributed separately from HOL analysis.