https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 16:18:26 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-125123 <p>compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint&#39;s argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0.</p> <p>compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint&#39;s argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-125123 https://db.gcve.eu/vuln/ghsa-8v59-qmwv-4p6q <p><strong>Affected:</strong> PyPI: compose-lint</p> <p>### Impact</p> <p>0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint&#39;s output. The fix escapes the command openers in compose-lint&#39;s own output, but not in the argument parser&#39;s error messages. When a repository path reaches compose-lint&#39;s arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.</p> <p>A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.</p> <p>Affected setups pass repository paths to compose-lint without a `--` before them: the pre-commit hook when `args:` is set without the documented trailing `--`, or the `compose-lint` package or Docker image called that way in a workflow. The pre-commit hook&#39;s default configuration passes `--` and is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.</p> <p>Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.</p> <p>**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.</p> <p>Releases b…</p> <p><strong>Affected:</strong> PyPI: compose-lint</p> <p>### Impact</p> <p>0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint&#39;s output. The fix escapes the command openers in compose-lint&#39;s own output, but not in the argument parser&#39;s error messages. When a repository path reaches compose-lint&#39;s arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.</p> <p>A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.</p> <p>Affected setups pass repository paths to compose-lint without a `--` before them: the pre-commit hook when `args:` is set without the documented trailing `--`, or the `compose-lint` package or Docker image called that way in a workflow. The pre-commit hook&#39;s default configuration passes `--` and is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.</p> <p>Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.</p> <p>**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.</p> <p>Releases b…</p> https://db.gcve.eu/vuln/ghsa-8v59-qmwv-4p6q