Is CVE-2026-125122 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125122 being exploited in the wild.

How severe is CVE-2026-125122?

Medium severity, with a CVSS score of 4, published 10 November 2026.

Which products and versions are affected?

compose-lint (PyPI) = 0.31.0, ECOSYSTEM:introduced=0.31.0,fixed=0.32.0; Tmatens Compose-Lint 0.31.0.

How is CVE-2026-125122 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-125122?

Check whether you run compose-lint (PyPI) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125122: compose-lint CI command injection in JSON and SARIF output

CVE-2026-125122 · Severity: medium · CVSS 4 · Published 2026-11-10

compose-lint is a Docker Compose security linter that checks configurations before deployment. In version 0.31.0, malicious Docker Compose service names or other values can inject GitHub Actions workflow commands into JSON or SARIF output, allowing an attacker to execute arbitrary commands in CI/CD pipelines when a pull request with crafted Compose files is analyzed.

Technologies: compose-lint (PyPI), Tmatens Compose-Lint. Vendors: PyPI, Tmatens.

Quick answers

Is CVE-2026-125122 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125122 being exploited in the wild.
How severe is CVE-2026-125122?: Medium severity, with a CVSS score of 4, published 10 November 2026.
Which products and versions are affected?: compose-lint (PyPI) = 0.31.0, ECOSYSTEM:introduced=0.31.0,fixed=0.32.0; Tmatens Compose-Lint 0.31.0.
Is there a fix for CVE-2026-125122?: Yes. compose-lint (PyPI): upgrade to 0.32.0 or later. Until then: Do not use compose-lint 0.31.0 with untrusted Docker Compose files in GitHub Actions workflows, or capture JSON and SARIF output to files instead of printing to stdout where workflow commands are interpreted. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125122 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-125122?: Check whether you run compose-lint (PyPI) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

compose-lint (PyPI): upgrade to 0.32.0 or later
```
pip install "compose-lint>=0.32.0"
```

Do not use compose-lint 0.31.0 with untrusted Docker Compose files in GitHub Actions workflows, or capture JSON and SARIF output to files instead of printing to stdout where workflow commands are interpreted.

Technical details

The vulnerability is an improper input sanitization flaw where the ##[ workflow-command opener is not escaped in JSON or SARIF output sent to stdout in version 0.31.0. An attacker can place the opener in Docker Compose values (such as service names), and when the output is printed to the job log, the GitHub Actions runner will interpret and execute the malicious workflow command. The flaw affects only stdout output via --format json or --format sarif; writing to files or using the GitHub Action directly is unaffected. The fix, released in version 0.32.0, escapes the command openers as defused strings.

Affected products

tmatens compose-lint 0.31.0

Identifiers

CVE-2026-125122
GHSA-hr4h-4c45-v4q4

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.