CVE-2026-125123: Improper Output Neutralization and CI Workflow Command Injection in compose-lint CLI Parser

Vulnerability ID: CVE-2026-125123
CVSS Score: 2.3
Published: 2026-11-10

An improper output neutralization vulnerability (CWE-117 / CWE-150) exists in compose-lint version 0.31.0. When compose-lint is invoked on untrusted file paths without a preceding '--' option delimiter, Python's standard argparse module rejects malformed or dash-prefixed paths and writes them directly to standard error without passing through the application's output sanitizer. An attacker submitting a pull request containing crafted directory or file names with carriage returns or Unicode whitespace can inject arbitrary CI workflow commands into GitHub Actions or Azure Pipelines job logs.

TL;DR

compose-lint 0.31.0 fails to sanitize CLI argument parsing errors written to stderr by Python's argparse, allowing attackers to inject CI workflow commands via maliciously named file paths in pull requests when invoked without the '--' separator. Fixed in version 0.32.0.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-125123 (GHSA-8v59-qmwv-4p6q)
• Weakness Class: CWE-117 (Improper Output Neutralization for Logs) / CWE-150
• CVSS v4.0 Score: 2.3 Low (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N)
• Affected Component: compose-lint CLI Argument Parser (src/compose_lint/cli.py & _output.py)
• Affected Version: 0.31.0 (Fixed in 0.32.0)
• Attack Vector: Network (Crafted file paths in Pull Requests passed to CLI without '--')
• Impact: CI Workflow Command Injection in GitHub Actions / Azure Pipelines logs
• CISA KEV Status: Not Listed

Affected Systems

• compose-lint
• compose-lint: = 0.31.0 (Fixed in: 0.32.0)

Code Analysis

Commit: 542e631

Route argparse output through sanitizer and neutralize Unicode whitespace, Azure Pipelines tokens, and JSON/SARIF command openers (PR #945)

--- a/src/compose_lint/cli.py
+++ b/src/compose_lint/cli.py
@@ ...
+class _Parser(argparse.ArgumentParser):
+    def print_usage(self, file: SupportsWrite[str] | None = None) -> None:
+        self._emit(self.format_usage(), file)
+
+    def print_help(self, file: SupportsWrite[str] | None = None) -> None:
+        self._emit(self.format_help(), file)
+
+    def exit(self, status: int = 0, message: str | None = None) -> NoReturn:
+        if message:
+            emit_block(message)
+        sys.exit(status)
+
+    @staticmethod
+    def _emit(text: str, file: SupportsWrite[str] | None) -> None:
+        if file is sys.stderr:
+            emit_block(text)
+        else:
+            (sys.stdout if file is None else file).write(sanitize(text))
--- a/src/compose_lint/_output.py
+++ b/src/compose_lint/_output.py
@@ ...
-_LEGACY_COMMAND = re.compile(r"##\[")
-_LINE_COMMAND = re.compile(r"^([ \t]*):(?=:)", re.MULTILINE)
+_LEGACY_COMMAND = re.compile(r"##(vso)?\[", re.IGNORECASE)
+_LINE_COMMAND = re.compile(r"^([^\S\n]*):(?=:)", re.MULTILINE)

Exploit Details

• GitHub: Official regression tests demonstrating CLI argument injection with carriage returns, Unicode whitespace, and Azure Pipelines tokens.

Mitigation Strategies

• Upgrade compose-lint to version 0.32.0 or later across all CI/CD pipelines, Docker environments, and developer workstations.
• Enforce the use of the '--' option-terminating delimiter before passing positional file path arguments in custom shell scripts and CI workflows.
• Use the official compose-lint GitHub Action or default pre-commit configuration, both of which isolate argument handling and disable inline workflow commands via stop-commands tokens.
• Remove unnecessary GitHub Actions problem matchers (e.g., via '::remove-matcher owner=python::') before running linters on untrusted pull requests.

Remediation Steps:

1. Update Python dependencies to require compose-lint>=0.32.0.
2. Update Docker image references to composelint/compose-lint:0.32.0 or later.
3. Update .pre-commit-config.yaml references to rev: v0.32.0.
4. Audit CI workflow YAML files (.github/workflows/*.yml, azure-pipelines.yml) and modify any direct CLI calls from 'compose-lint $FILES' to 'compose-lint -- $FILES'.

References

• GitHub Security Advisory GHSA-8v59-qmwv-4p6q
• compose-lint Pull Request #945
• Fix Commit 542e63126f795564a65c63887ea0dc558a500688
• compose-lint v0.32.0 Release Notes
• CVE.org Record: CVE-2026-125123
• NVD Detail: CVE-2026-125123

Read the full report for CVE-2026-125123 on our website for more details including interactive diagrams and full exploit analysis.