Security advisories

low2026-11-10

CVE-2026-125123-compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages 

GHSA-8v59-qmwv-4p6q

low2026-11-10

CVE-2026-125125- compose-lint: Workflow command injection through SARIF-directory errors triggered by pull request symlinks 

GHSA-xcf7-88g6-7xr8

low2026-11-10

CVE-2026-125122-compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout

GHSA-hr4h-4c45-v4q4

medium2026-11-10

CVE-2026-125121-compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

GHSA-r7j4-crjv-h467

low2026-11-10

CVE-2026-123796-compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

GHSA-rm8w-w798-g545

low2026-11-10

CVE-2026-123373-compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output

GHSA-whr6-fgpq-fpv9

low2026-11-10

CVE-2026-123371-compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target

GHSA-88f4-frh5-gmcr

low2026-11-10

CVE-2026-123372-compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

GHSA-jf3h-8jvx-vcrg

medium2026-11-10

CVE-2026-123370-compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

GHSA-65v8-q222-64xx

medium2026-11-10

CVE-2026-123369-compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

GHSA-6f4g-xm8v-pgv6

low2026-11-10

CVE-2026-123368-compose-lint: .env read through a symlink outside the project can expose the CI job's environment

GHSA-6wcv-rj3c-mhv3