GHSA-6f4g-xm8v-pgv6: compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
compose-lintto a version that resolves this vulnerability.Fixed in 0.31.0
Event History
Frequently Asked Questions
Which CI workflows are exposed to this issue?
Workflows that run the compose-lint Action on pull-request-controlled Compose content are exposed if they use a compose-lint version earlier than 0.31.0. The risk is to the integrity of runner-recognized log output shown to reviewers.
What must an attacker control to exploit it?
An attacker needs to cause compose-lint to print crafted Compose text, such as service names, environment keys, or file lines, containing GitHub Actions or Azure Pipelines workflow-command openers. User interaction is required because a workflow must process the attacker-controlled pull request content.
Can this change whether the CI check passes or fails?
No. The affected text-reporting paths do not change compose-lint's exit code or its pass/fail result, but they can create misleading annotations, conceal log regions, mask selected strings, or trigger other runner-recognized commands.
What is the remediation?
Upgrade compose-lint to version 0.31.0, which fixes the workflow-command neutralization issue.