https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 15:08:36 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-123369 <p>compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.</p> <p>compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-123369 https://db.gcve.eu/vuln/ghsa-6f4g-xm8v-pgv6 <p><strong>Affected:</strong> GitHub Actions: tmatens/compose-lint, PyPI: compose-lint</p> <p>### Impact</p> <p>The GitHub Actions runner treats certain text in a step&#39;s output as commands. The legacy form, `##[command]`, is recognized anywhere in a line. compose-lint&#39;s text report prints service names, environment keys and lines of the Compose file, and it does not neutralize `##[`. Inside the compose-lint Action, a Compose file from a pull request can therefore:</p> <p>- create fake error or warning annotations on the pull request (`##[error]`, `##[warning]`) - fold the rest of the log, including the real verdict, out of sight (`##[group]`) - blank out chosen strings for the rest of the log (`##[add-mask]`)</p> <p>GitHub has postponed removing the deprecated `set-output` log command, so the runner still honors it. A test run of the Action on a GitHub-hosted runner confirmed that a `::set-output` line from a Compose file is processed. Whether it can override the Action&#39;s own `sarif-written` output, which decides whether the SARIF upload step runs, has not been tested.</p> <p>The exit code and the pass/fail result are not affected. Azure Pipelines parses the same `##[` syntax, so the pip package is listed for anyone printing the text report in other CI systems.</p> <p>Found during an internal pre-1.0 security review.</p> <p>### Patches</p> <p>Fixed in 0.31.0. The Action stops the runner from processing workflow commands while compose-lint&#39;s output is printed, using a random `stop-commands` token. The text report also escapes `##[`, and `::` at the start of a line, in anything taken from the Compose file.</p> <p>##…</p> <p><strong>Affected:</strong> GitHub Actions: tmatens/compose-lint, PyPI: compose-lint</p> <p>### Impact</p> <p>The GitHub Actions runner treats certain text in a step&#39;s output as commands. The legacy form, `##[command]`, is recognized anywhere in a line. compose-lint&#39;s text report prints service names, environment keys and lines of the Compose file, and it does not neutralize `##[`. Inside the compose-lint Action, a Compose file from a pull request can therefore:</p> <p>- create fake error or warning annotations on the pull request (`##[error]`, `##[warning]`) - fold the rest of the log, including the real verdict, out of sight (`##[group]`) - blank out chosen strings for the rest of the log (`##[add-mask]`)</p> <p>GitHub has postponed removing the deprecated `set-output` log command, so the runner still honors it. A test run of the Action on a GitHub-hosted runner confirmed that a `::set-output` line from a Compose file is processed. Whether it can override the Action&#39;s own `sarif-written` output, which decides whether the SARIF upload step runs, has not been tested.</p> <p>The exit code and the pass/fail result are not affected. Azure Pipelines parses the same `##[` syntax, so the pip package is listed for anyone printing the text report in other CI systems.</p> <p>Found during an internal pre-1.0 security review.</p> <p>### Patches</p> <p>Fixed in 0.31.0. The Action stops the runner from processing workflow commands while compose-lint&#39;s output is printed, using a random `stop-commands` token. The text report also escapes `##[`, and `::` at the start of a line, in anything taken from the Compose file.</p> <p>##…</p> https://db.gcve.eu/vuln/ghsa-6f4g-xm8v-pgv6