- Severity: MEDIUM
- CVE: CVE-2026-125121
- Ecosystems: pip
- Packages: compose-lint
### Impact
0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint’s output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report “escapes both openers (also covering Azure Pipelines)”. Five paths were left open:
– **Unicode whitespace before a line-leading `::`.** The runner strips all Unicode whitespace from the start of a line before it looks for a command. compose-lint only accounted for spaces and tabs, so a no-break space or another Unicode space ahead of `::` is not escaped. It can come from a Compose value, or from a file name: the text report’s file heading and per-file summary, and the `fix` summary on stderr, start with the path as given, so a directory named with a leading no-break space followed by `::` puts a command at the start of a line. This reaches those lines, the text report’s fix guidance, the `fix` dry-run diff, and continuation lines of stderr diagnostics.
– **JSON and SARIF printed to stdout.** `–format json` and `–format sarif` output never passed through the sanitizer, so `##[` inside a service name or other value reaches the log intact when the output isn’t redirected to a file.
– **Command-line errors.** When a repository path reaches compose-lint’s arguments without a `–` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a comm…
Source: GitHub Security Advisories · 2026-11-10