# CVE-2026-125125: compose-lint GitHub Action workflow command injection via symlink path

Source: https://junglewise.ai/threats/cve-2026-125125-compose-lint-is-a-docker-compose-security-linter-that-identifies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125125 · Severity: low · Published 2026-11-10

compose-lint is a Docker Compose security linter distributed as a GitHub Action for identifying deployment misconfigurations. In versions 0.30.0 through 0.31.0, an attacker can inject arbitrary workflow commands into CI job logs by crafting a symlink with a malicious directory name, potentially allowing execution of unintended commands or disclosure of secrets during pull request runs.

Technologies: [tmatens/compose-lint (GitHub Actions)](https://junglewise.ai/threats/technologies/actions-tmatens-compose-lint), [Tmatens Compose-Lint](https://junglewise.ai/threats/technologies/tmatens-compose-lint). Vendors: [GitHub Actions](https://junglewise.ai/threats/vendors/actions), [Tmatens](https://junglewise.ai/threats/vendors/tmatens).

## Quick answers

**Is CVE-2026-125125 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125125 being exploited in the wild.

**How severe is CVE-2026-125125?** Low severity, published 10 November 2026.

**Which products and versions are affected?** tmatens/compose-lint (GitHub Actions) >= 0.30.0, <= 0.31.0; Tmatens Compose-Lint 0.30.0 through 0.31.0.

**Is there a fix for CVE-2026-125125?** Yes: fixed in 0.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125125 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-125125?** Check whether you run tmatens/compose-lint (GitHub Actions) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.32.0

## Technical details

A workflow command injection vulnerability exists in the compose-lint GitHub Action when processing SARIF output to a subdirectory. The action fails to properly escape CI command openers (##[, ##vso[) in resolved directory paths printed to the job log when SARIF directory creation fails. An attacker can create a committed symlink whose target directory name contains a newline followed by a valid workflow command syntax to trigger execution. The vulnerability requires the sarif-file input to reference a subdirectory; the compose-lint package, pre-commit hook, and Docker image are unaffected. The issue is patched in version 0.32.0.

## Affected products

- tmatens compose-lint 0.30.0 through 0.31.0

## Identifiers

- CVE-2026-125125
- GHSA-xcf7-88g6-7xr8

## Timeline

- 2026-11-10: disclosed
- 2026-09-28: patched

## References

- [https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688](https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688)
- [https://github.com/tmatens/compose-lint/pull/945](https://github.com/tmatens/compose-lint/pull/945)

## Related threats

- [compose-lint insufficient CI command sanitization](https://junglewise.ai/threats/cve-2026-125124-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint command injection via unsanitized stderr output](https://junglewise.ai/threats/cve-2026-125123-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint CI command injection in JSON and SARIF output](https://junglewise.ai/threats/cve-2026-125122-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint workflow command injection via Unicode whitespace](https://junglewise.ai/threats/cve-2026-125121-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint information disclosure via incomplete .env remediation at finding limit](https://junglewise.ai/threats/cve-2026-123796-compose-lint-is-a-docker-compose-security-linter-that-identifies)