https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 16:18:28 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-125125 <p>compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.</p> <p>compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-125125 https://db.gcve.eu/vuln/ghsa-xcf7-88g6-7xr8 <p><strong>Affected:</strong> GitHub Actions: tmatens/compose-lint</p> <p>### Impact</p> <p>In Action tags v0.30.0 and v0.31.0, when `sarif-file:` names a file in a subdirectory that can&#39;t be created, the Action prints the directory&#39;s resolved path in an error message. In v0.31.0 that message is outside the window in which the Action turns command processing off, and v0.30.0 has no such window. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command.</p> <p>A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.</p> <p>Only the Action is affected, and only when `sarif-file:` points into a subdirectory. The documented setup, `sarif-file: results.sarif` at the repository root, is not affected. The `compose-lint` package, the pre-commit hook and the Docker image do not print this message.</p> <p>Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.</p> <p>### Patches</p> <p>Fixed in 0.32.0. The SARIF-directory error names the `sarif-file:` input as written.</p> <p>### Workarounds</p> <p>- Upgrade to 0.32.0 or later. - Keep `sarif-file` at the workspace root, for example `sarif-file: results.sarif`.</p> <p>### Reproduction</p> <p>On a GitHub-hosted runner (runner 2.337.0), the Action at v0.31.0 with `sarif-file: out/reports/results.sarif`, where `out` is…</p> <p><strong>Affected:</strong> GitHub Actions: tmatens/compose-lint</p> <p>### Impact</p> <p>In Action tags v0.30.0 and v0.31.0, when `sarif-file:` names a file in a subdirectory that can&#39;t be created, the Action prints the directory&#39;s resolved path in an error message. In v0.31.0 that message is outside the window in which the Action turns command processing off, and v0.30.0 has no such window. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command.</p> <p>A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.</p> <p>Only the Action is affected, and only when `sarif-file:` points into a subdirectory. The documented setup, `sarif-file: results.sarif` at the repository root, is not affected. The `compose-lint` package, the pre-commit hook and the Docker image do not print this message.</p> <p>Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.</p> <p>### Patches</p> <p>Fixed in 0.32.0. The SARIF-directory error names the `sarif-file:` input as written.</p> <p>### Workarounds</p> <p>- Upgrade to 0.32.0 or later. - Keep `sarif-file` at the workspace root, for example `sarif-file: results.sarif`.</p> <p>### Reproduction</p> <p>On a GitHub-hosted runner (runner 2.337.0), the Action at v0.31.0 with `sarif-file: out/reports/results.sarif`, where `out` is…</p> https://db.gcve.eu/vuln/ghsa-xcf7-88g6-7xr8