GHSA-R7J4-CRJV-H467 compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report "escapes both openers also covering Azure...

compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report "escapes both openers also covering Azure...

CVE-2026-125122 compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0's JSON and SARIF output on stdout

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener i...

CVE-2026-125122

The compose-lint Docker Compose security linter (version 0.31.0 ) fails to sanitize the ##[ workflow-command opener within strings when using the --format json or --format sarif flags to stdout. An attacker could include this opener in a pull request via a service name or other Compose value. Whe...

CVE-2026-125121 compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before...

CVE-2026-125121

The compose-lint security linter for Docker Compose is vulnerable in version 0.31.0 . The root cause is that the tool only escapes GitHub Actions workflow-command openers after ASCII spaces and tabs , whereas the runner strips leading Unicode whitespace . Consequently, untrusted Compose values or...

CVE-2026-123369

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines...

CVE-2026-123369 compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines...

CVE-2026-123369 compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines...

CVE-2026-123369

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines...

CVE-2026-123369

The compose-lint Docker Compose security linter is vulnerable to command injection via log output prior to version 0.31.0 . The tool fails to neutralize workflow-command openers in attacker-controlled strings such as service names, environment keys, or file lines. When processing a pull request, ...

CVE-2026-123369 compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines...

CVE-2026-123369: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines...

CVE-2026-118762

A flaw was found in Monkeytype. Its continuous integration CI workflow improperly executes untrusted code from external pull requests with elevated write permissions. A remote attacker can submit a pull request containing malicious code that executes within the build environment, allowing them to...

CVE-2026-114134

A flaw was found in the Black GitHub Action. When configured to read project settings from a configuration file, the action fails to validate the specified version identifier. A remote attacker capable of submitting a pull request can supply a reference to external malicious code, leading to...

CVE-2026-118762

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pullrequesttarget with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the...

CVE-2026-118762 Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pullrequesttarget with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the...

CVE-2026-118762 Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pullrequesttarget with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the...

EUVD-2026-113222

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pullrequesttarget with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the...

PT-2026-132397

Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull request target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the...