# CVE-2026-125123: compose-lint command injection via unsanitized stderr output

Source: https://junglewise.ai/threats/cve-2026-125123-compose-lint-is-a-docker-compose-security-linter-that-identifies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125123 · Severity: medium · CVSS 4 · Published 2026-11-10

compose-lint is a Docker Compose security linter used to prevent misconfigurations before deployment. In version 0.31.0, it can be exploited to inject GitHub Actions workflow commands through the standard error output, potentially allowing attackers to execute arbitrary commands in CI/CD pipelines. This affects users whose pre-commit or Docker configurations pass repository paths without the -- separator.

Technologies: [compose-lint (PyPI)](https://junglewise.ai/threats/technologies/pypi-compose-lint), [Tmatens Compose-Lint](https://junglewise.ai/threats/technologies/tmatens-compose-lint). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Tmatens](https://junglewise.ai/threats/vendors/tmatens).

## Quick answers

**Is CVE-2026-125123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125123 being exploited in the wild.

**How severe is CVE-2026-125123?** Medium severity, with a CVSS score of 4, published 10 November 2026.

**Which products and versions are affected?** compose-lint (PyPI) = 0.31.0, ECOSYSTEM:introduced=0.31.0,fixed=0.32.0; Tmatens Compose-Lint 0.31.0.

**Is there a fix for CVE-2026-125123?** Yes. compose-lint (PyPI): upgrade to 0.32.0 or later. Until then: The default pre-commit configuration includes the -- separator and is unaffected; use that configuration or ensure the -- separator is always provided when invoking compose-lint. The GitHub Action is not affected and requires no changes.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-10"}, {"kind": "patched", "at": "2026-09-28"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125123 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-125123?** Check whether you run compose-lint (PyPI) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- compose-lint (PyPI): upgrade to 0.32.0 or later

  ```sh
  pip install "compose-lint>=0.32.0"
  ```


The default pre-commit configuration includes the -- separator and is unaffected; use that configuration or ensure the -- separator is always provided when invoking compose-lint. The GitHub Action is not affected and requires no changes.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-10"}, {"kind": "patched", "at": "2026-09-28"}]

## Technical details

The vulnerability is a command injection issue in compose-lint's argument parser (CWE-94). When repository paths are passed without a -- separator, the parser writes rejected paths to stderr without sanitizing GitHub Actions workflow-command syntax (##[...] and ##vso[). An attacker can craft a path containing carriage returns and workflow commands to execute arbitrary commands in the GitHub Actions runner. The vulnerability requires the package to be invoked with unsanitized user input, which is not the case in the default pre-commit configuration or official GitHub Action.

## Affected products

- tmatens compose-lint 0.31.0

## Identifiers

- CVE-2026-125123
- GHSA-8v59-qmwv-4p6q

## References

- [https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688](https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688)
- [https://github.com/tmatens/compose-lint/pull/945](https://github.com/tmatens/compose-lint/pull/945)

## Related threats

- [compose-lint GitHub Action workflow command injection via symlink path](https://junglewise.ai/threats/cve-2026-125125-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint insufficient CI command sanitization](https://junglewise.ai/threats/cve-2026-125124-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint CI command injection in JSON and SARIF output](https://junglewise.ai/threats/cve-2026-125122-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint workflow command injection via Unicode whitespace](https://junglewise.ai/threats/cve-2026-125121-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint information disclosure via incomplete .env remediation at finding limit](https://junglewise.ai/threats/cve-2026-123796-compose-lint-is-a-docker-compose-security-linter-that-identifies)