https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 16:05:48 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-125121 <p>compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.</p> <p>compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-125121 https://db.gcve.eu/vuln/ghsa-r7j4-crjv-h467 <p><strong>Affected:</strong> PyPI: compose-lint</p> <p>### Impact</p> <p>0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint&#39;s output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report &#34;escapes both openers (also covering Azure Pipelines)&#34;. Five paths were left open:</p> <p>- **Unicode whitespace before a line-leading `::`.** The runner strips all Unicode whitespace from the start of a line before it looks for a command. compose-lint only accounted for spaces and tabs, so a no-break space or another Unicode space ahead of `::` is not escaped. It can come from a Compose value, or from a file name: the text report&#39;s file heading and per-file summary, and the `fix` summary on stderr, start with the path as given, so a directory named with a leading no-break space followed by `::` puts a command at the start of a line. This reaches those lines, the text report&#39;s fix guidance, the `fix` dry-run diff, and continuation lines of stderr diagnostics. - **JSON and SARIF printed to stdout.** `--format json` and `--format sarif` output never passed through the sanitizer, so `##[` inside a service name or other value reaches the log intact when the output isn&#39;t redirected to a file. - **Command-line errors.** When a repository path reaches compose-lint&#39;s arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a com…</p> <p><strong>Affected:</strong> PyPI: compose-lint</p> <p>### Impact</p> <p>0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint&#39;s output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report &#34;escapes both openers (also covering Azure Pipelines)&#34;. Five paths were left open:</p> <p>- **Unicode whitespace before a line-leading `::`.** The runner strips all Unicode whitespace from the start of a line before it looks for a command. compose-lint only accounted for spaces and tabs, so a no-break space or another Unicode space ahead of `::` is not escaped. It can come from a Compose value, or from a file name: the text report&#39;s file heading and per-file summary, and the `fix` summary on stderr, start with the path as given, so a directory named with a leading no-break space followed by `::` puts a command at the start of a line. This reaches those lines, the text report&#39;s fix guidance, the `fix` dry-run diff, and continuation lines of stderr diagnostics. - **JSON and SARIF printed to stdout.** `--format json` and `--format sarif` output never passed through the sanitizer, so `##[` inside a service name or other value reaches the log intact when the output isn&#39;t redirected to a file. - **Command-line errors.** When a repository path reaches compose-lint&#39;s arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a com…</p> https://db.gcve.eu/vuln/ghsa-r7j4-crjv-h467