Is CVE-2026-125125 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125125 being exploited in the wild.

How severe is CVE-2026-125125?

Low severity, published 10 November 2026.

Which products and versions are affected?

tmatens/compose-lint (GitHub Actions) >= 0.30.0, <= 0.31.0; Tmatens Compose-Lint 0.30.0 through 0.31.0.

Is there a fix for CVE-2026-125125?

Yes: fixed in 0.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125125 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-125125?

Check whether you run tmatens/compose-lint (GitHub Actions) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125125: compose-lint GitHub Action workflow command injection via symlink path

Q: Is there a fix for CVE-2026-125125?

Yes: fixed in 0.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-125125 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-125125?

Check whether you run tmatens/compose-lint (GitHub Actions) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125125 · Severity: low · Published 2026-11-10

compose-lint is a Docker Compose security linter distributed as a GitHub Action for identifying deployment misconfigurations. In versions 0.30.0 through 0.31.0, an attacker can inject arbitrary workflow commands into CI job logs by crafting a symlink with a malicious directory name, potentially allowing execution of unintended commands or disclosure of secrets during pull request runs.

Technologies: tmatens/compose-lint (GitHub Actions), Tmatens Compose-Lint. Vendors: GitHub Actions, Tmatens.

Quick answers

Is CVE-2026-125125 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125125 being exploited in the wild.
How severe is CVE-2026-125125?: Low severity, published 10 November 2026.
Which products and versions are affected?: tmatens/compose-lint (GitHub Actions) >= 0.30.0, <= 0.31.0; Tmatens Compose-Lint 0.30.0 through 0.31.0.
Is there a fix for CVE-2026-125125?: Yes: fixed in 0.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125125 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-125125?: Check whether you run tmatens/compose-lint (GitHub Actions) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.32.0

Technical details

A workflow command injection vulnerability exists in the compose-lint GitHub Action when processing SARIF output to a subdirectory. The action fails to properly escape CI command openers (##[, ##vso[) in resolved directory paths printed to the job log when SARIF directory creation fails. An attacker can create a committed symlink whose target directory name contains a newline followed by a valid workflow command syntax to trigger execution. The vulnerability requires the sarif-file input to reference a subdirectory; the compose-lint package, pre-commit hook, and Docker image are unaffected. The issue is patched in version 0.32.0.

Affected products

tmatens compose-lint 0.30.0 through 0.31.0

Identifiers

CVE-2026-125125
GHSA-xcf7-88g6-7xr8

Timeline

2026-11-10: disclosed
2026-09-28: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.