VULN/vuln-osv
1
0
Fork 0
Code Pull Requests Actions Activity

vuln-osv update 2026-11-11T00:44:13Z

Browse Source
This commit is contained in:
Vulnerability Bot
2026-11-11 01:44:18 +01:00
parent 333115c3ef
commit 42a6092ecf
70 changed files with 92 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/PyPI/GHSA-8v59-qmwv-4p6q.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"GHSA-8v59-qmwv-4p6q","published":"2026-11-10T21:58:53Z","modified":"2026-11-10T22:15:03.405244565Z","aliases":["CVE-2026-125123"],"summary":"compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages ","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in compose-lint's own output, but not in the argument parser's error messages. When a repository path reaches compose-lint's arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups pass repository paths to compose-lint without a `--` before them: the pre-commit hook when `args:` is set without the documented trailing `--`, or the `compose-lint` package or Docker image called that way in a workflow. The pre-commit hook's default configuration passes `--` and is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.\n\n### Patches\n\nFixed in 0.32.0. The argument parser's messages go through the same sanitizer as the rest of compose-lint's output.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- End the pre-commit hook's `args:` with `--`, and put `--` before file paths when calling compose-lint directly.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::<random token>` and `::<token>::`, as the Action does.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), `compose-lint '--##[warning]X/compose.yml'` with no `--` creates an annotation. The same path after `--` creates none. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8v59-qmwv-4p6q/GHSA-8v59-qmwv-4p6q.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125123"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:58:53Z","nvd_published_at":"2026-11-10T17:17:26Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}
data/PyPI/GHSA-hr4h-4c45-v4q4.json
+1
View File
@@ -0,0 +1 @@
{"schema_version":"1.9.2","id":"GHSA-hr4h-4c45-v4q4","published":"2026-11-10T21:40:50Z","modified":"2026-11-10T22:00:03.806318604Z","aliases":["CVE-2026-125122"],"summary":"compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. `--format json` and `--format sarif` output never passed through that fix, so `##[` inside a service name or other value reaches the log intact when the output is printed to stdout rather than written to a file. The runner acts on `##[` in the middle of a line, so the JSON layout does not prevent it.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups print JSON or SARIF output to a CI log from the `compose-lint` package, the pre-commit hook or the Docker image. Writing that output to a file, which SARIF upload requires, is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.\n\nFound during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.\n\n### Patches\n\nFixed in 0.32.0. JSON and SARIF on stdout escape `##[` inside strings as `\\u005b`, which decodes to the same data.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- Write `--format json` and `--format sarif` output to a file rather than the log.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::<random token>` and `::<token>::`, as the Action does.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), a service named `a##[warning]X`, linted with `--format json` or `--format sarif` to stdout, creates annotations. The same file linted with the text report creates none. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hr4h-4c45-v4q4/GHSA-hr4h-4c45-v4q4.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125122"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T21:40:50Z","nvd_published_at":"2026-11-10T17:17:26Z","severity":"LOW"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]}