Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-123796 (GCVE-0-2026-123796)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:48 – Updated: 2026-11-09 17:48

Title

compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/978	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/31…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.32.0, < 0.33.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.32.0, \u003c 0.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint\u0027s incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:48:15.456Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-rm8w-w798-g545",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-rm8w-w798-g545"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/978",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/978"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.33.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.33.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rm8w-w798-g545",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123796",
    "datePublished": "2026-11-09T17:48:15.456Z",
    "dateReserved": "2026-11-06T15:27:56.225Z",
    "dateUpdated": "2026-11-09T17:48:15.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123373 (GCVE-0-2026-123373)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:46 – Updated: 2026-11-09 22:57

Title

compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:57 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/721	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/36…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.2.0, < 0.25.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:57:30.423283Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:57:41.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.2.0, \u003c 0.25.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:46:13.505Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/721",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/721"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.25.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.25.0"
        }
      ],
      "source": {
        "advisory": "GHSA-whr6-fgpq-fpv9",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123373",
    "datePublished": "2026-11-09T17:46:13.505Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T22:57:41.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123372 (GCVE-0-2026-123372)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:38 – Updated: 2026-11-09 17:39

Title

compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/944	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/97…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.22.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:39:27.049Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/944",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/944"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jf3h-8jvx-vcrg",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123372",
    "datePublished": "2026-11-09T17:38:24.683Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:39:27.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123371 (GCVE-0-2026-123371)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:36 – Updated: 2026-11-09 17:36

Title

compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external file fails YAML parsing. A pull request can point the policy file at a runner credential file, causing about 30 characters around an attacker-uncontrolled parse position to appear in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. The run exits with an error and the attacker cannot select the exact disclosed line, but public logs or Code Scanning output can reveal part of the target. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/943	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/e8…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.2.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.2.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external file fails YAML parsing. A pull request can point the policy file at a runner credential file, causing about 30 characters around an attacker-uncontrolled parse position to appear in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. The run exits with an error and the attacker cannot select the exact disclosed line, but public logs or Code Scanning output can reveal part of the target. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:36:29.552Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-88f4-frh5-gmcr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-88f4-frh5-gmcr"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/943",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/943"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/e80547d33b2114040c4bc0e34ef210aee51f5058",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/e80547d33b2114040c4bc0e34ef210aee51f5058"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-88f4-frh5-gmcr",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123371",
    "datePublished": "2026-11-09T17:36:29.552Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:36:29.552Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123370 (GCVE-0-2026-123370)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:34 – Updated: 2026-11-09 17:34

Title

compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CWE

CWE-193 - Off-by-one Error

Assigner

GitHub_M CNA

References

6 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/547	x_refsource_MISC
https://github.com/tmatens/compose-lint/pull/549	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/c9…	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/cb…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.9.0, < 0.18.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.9.0, \u003c 0.18.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint\u0027s YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-193",
              "description": "CWE-193: Off-by-one Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:34:24.026Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/547",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/547"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/549",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/549"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.18.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.18.0"
        }
      ],
      "source": {
        "advisory": "GHSA-65v8-q222-64xx",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: `fix --apply` can delete a line the user did not select, including a security setting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123370",
    "datePublished": "2026-11-09T17:34:24.026Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:34:24.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123369 (GCVE-0-2026-123369)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:32 – Updated: 2026-11-09 22:55

Title

compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:52 UTC

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/918	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/67…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: < 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:52:06.368275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:55:25.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:32:25.031Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/918",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/918"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6f4g-xm8v-pgv6",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123369",
    "datePublished": "2026-11-09T17:32:25.031Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T22:55:25.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123368 (GCVE-0-2026-123368)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:25 – Updated: 2026-11-09 17:25

Title

compose-lint: .env read through a symlink outside the project can expose the CI job's environment

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M CNA

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/917	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/c4…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.22.0, < 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:25:15.559Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6wcv-rj3c-mhv3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6wcv-rj3c-mhv3"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/917",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/917"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/c43204ad4dab11d54e20574a52bc4e5835246ca5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/c43204ad4dab11d54e20574a52bc4e5835246ca5"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6wcv-rj3c-mhv3",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: .env read through a symlink outside the project can expose the CI job\u0027s environment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123368",
    "datePublished": "2026-11-09T17:25:15.559Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:25:15.559Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

7 vulnerabilities by tmatens

CVE-2026-123796 (GCVE-0-2026-123796)

CVE-2026-123373 (GCVE-0-2026-123373)

CVE-2026-123372 (GCVE-0-2026-123372)

CVE-2026-123371 (GCVE-0-2026-123371)

CVE-2026-123370 (GCVE-0-2026-123370)

CVE-2026-123369 (GCVE-0-2026-123369)

CVE-2026-123368 (GCVE-0-2026-123368)