Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-125125 (GCVE-0-2026-125125)

Vulnerability from nvd – Published: 2026-11-10 16:55 – Updated: 2026-11-10 19:04

Title

compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 18:19 UTC

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.30.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125125",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:19:14.192887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:04:15.911Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.30.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:55:55.117Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xcf7-88g6-7xr8",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action\u0027s SARIF-directory error message"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125125",
    "datePublished": "2026-11-10T16:55:55.117Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T19:04:15.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125124 (GCVE-0-2026-125124)

Vulnerability from nvd – Published: 2026-11-10 16:53 – Updated: 2026-11-10 16:53

Title

compose-lint: Text in a pull request can reach Azure Pipelines as logging commands through compose-lint 0.31.0's output

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place that opener in a Compose value or file name, allowing output from the package, pre-commit hook, or Docker image to issue logging commands when printed to an Azure Pipelines job log. The maintainer did not reproduce the behavior on an Azure Pipelines agent. The GitHub Action is not affected because it runs only on GitHub Actions, and releases before 0.31.0 are outside this advisory because they did not claim Azure Pipelines coverage. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: = 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place that opener in a Compose value or file name, allowing output from the package, pre-commit hook, or Docker image to issue logging commands when printed to an Azure Pipelines job log. The maintainer did not reproduce the behavior on an Azure Pipelines agent. The GitHub Action is not affected because it runs only on GitHub Actions, and releases before 0.31.0 are outside this advisory because they did not claim Azure Pipelines coverage. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:53:57.148Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-m4xg-839g-24cv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-m4xg-839g-24cv"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-m4xg-839g-24cv",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Text in a pull request can reach Azure Pipelines as logging commands through compose-lint 0.31.0\u0027s output"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125124",
    "datePublished": "2026-11-10T16:53:57.148Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T16:53:57.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125123 (GCVE-0-2026-125123)

Vulnerability from nvd – Published: 2026-11-10 16:52 – Updated: 2026-11-10 21:06

Title

compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 21:06 UTC

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: = 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125123",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:06:15.458993Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:06:30.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint\u0027s argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:52:31.891Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8v59-qmwv-4p6q",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0\u0027s command-line error messages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125123",
    "datePublished": "2026-11-10T16:52:31.891Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T21:06:30.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125122 (GCVE-0-2026-125122)

Vulnerability from nvd – Published: 2026-11-10 16:50 – Updated: 2026-11-10 16:50

Title

compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0's JSON and SARIF output on stdout

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: = 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:50:46.826Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-hr4h-4c45-v4q4",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0\u0027s JSON and SARIF output on stdout"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125122",
    "datePublished": "2026-11-10T16:50:46.826Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T16:50:46.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125121 (GCVE-0-2026-125121)

Vulnerability from nvd – Published: 2026-11-10 16:43 – Updated: 2026-11-10 16:50

Title

compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/advisories/GHSA-6f4g-xm8v-pgv6	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.31.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.31.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:50:03.051Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/advisories/GHSA-6f4g-xm8v-pgv6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/advisories/GHSA-6f4g-xm8v-pgv6"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r7j4-crjv-h467",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0\u0027s output"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125121",
    "datePublished": "2026-11-10T16:43:01.275Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T16:50:03.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123796 (GCVE-0-2026-123796)

Vulnerability from nvd – Published: 2026-11-09 17:48 – Updated: 2026-11-09 17:48

Title

compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/978	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/31…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.32.0, < 0.33.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.32.0, \u003c 0.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint\u0027s incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:48:15.456Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-rm8w-w798-g545",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-rm8w-w798-g545"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/978",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/978"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.33.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.33.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rm8w-w798-g545",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123796",
    "datePublished": "2026-11-09T17:48:15.456Z",
    "dateReserved": "2026-11-06T15:27:56.225Z",
    "dateUpdated": "2026-11-09T17:48:15.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123373 (GCVE-0-2026-123373)

Vulnerability from nvd – Published: 2026-11-09 17:46 – Updated: 2026-11-09 22:57

Title

compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:57 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/721	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/36…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.2.0, < 0.25.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:57:30.423283Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:57:41.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.2.0, \u003c 0.25.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:46:13.505Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/721",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/721"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.25.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.25.0"
        }
      ],
      "source": {
        "advisory": "GHSA-whr6-fgpq-fpv9",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123373",
    "datePublished": "2026-11-09T17:46:13.505Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T22:57:41.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123372 (GCVE-0-2026-123372)

Vulnerability from nvd – Published: 2026-11-09 17:38 – Updated: 2026-11-09 17:39

Title

compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/944	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/97…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.22.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:39:27.049Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/944",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/944"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jf3h-8jvx-vcrg",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123372",
    "datePublished": "2026-11-09T17:38:24.683Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:39:27.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123371 (GCVE-0-2026-123371)

Vulnerability from nvd – Published: 2026-11-09 17:36 – Updated: 2026-11-10 19:11

Title

compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external file fails YAML parsing. A pull request can point the policy file at a runner credential file, causing about 30 characters around an attacker-uncontrolled parse position to appear in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. The run exits with an error and the attacker cannot select the exact disclosed line, but public logs or Code Scanning output can reveal part of the target. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 18:17 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/943	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/e8…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.2.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:17:53.850255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:11:49.813Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.2.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external file fails YAML parsing. A pull request can point the policy file at a runner credential file, causing about 30 characters around an attacker-uncontrolled parse position to appear in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. The run exits with an error and the attacker cannot select the exact disclosed line, but public logs or Code Scanning output can reveal part of the target. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:36:29.552Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-88f4-frh5-gmcr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-88f4-frh5-gmcr"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/943",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/943"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/e80547d33b2114040c4bc0e34ef210aee51f5058",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/e80547d33b2114040c4bc0e34ef210aee51f5058"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-88f4-frh5-gmcr",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123371",
    "datePublished": "2026-11-09T17:36:29.552Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-10T19:11:49.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123370 (GCVE-0-2026-123370)

Vulnerability from nvd – Published: 2026-11-09 17:34 – Updated: 2026-11-09 17:34

Title

compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CWE

CWE-193 - Off-by-one Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/547	x_refsource_MISC
https://github.com/tmatens/compose-lint/pull/549	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/c9…	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/cb…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.9.0, < 0.18.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.9.0, \u003c 0.18.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint\u0027s YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-193",
              "description": "CWE-193: Off-by-one Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:34:24.026Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/547",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/547"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/549",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/549"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.18.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.18.0"
        }
      ],
      "source": {
        "advisory": "GHSA-65v8-q222-64xx",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: `fix --apply` can delete a line the user did not select, including a security setting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123370",
    "datePublished": "2026-11-09T17:34:24.026Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:34:24.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123369 (GCVE-0-2026-123369)

Vulnerability from nvd – Published: 2026-11-09 17:32 – Updated: 2026-11-09 22:55

Title

compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:52 UTC

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/918	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/67…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: < 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:52:06.368275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:55:25.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:32:25.031Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/918",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/918"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6f4g-xm8v-pgv6",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123369",
    "datePublished": "2026-11-09T17:32:25.031Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T22:55:25.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123368 (GCVE-0-2026-123368)

Vulnerability from nvd – Published: 2026-11-09 17:25 – Updated: 2026-11-09 17:25

Title

compose-lint: .env read through a symlink outside the project can expose the CI job's environment

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/917	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/c4…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.22.0, < 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:25:15.559Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6wcv-rj3c-mhv3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6wcv-rj3c-mhv3"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/917",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/917"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/c43204ad4dab11d54e20574a52bc4e5835246ca5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/c43204ad4dab11d54e20574a52bc4e5835246ca5"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6wcv-rj3c-mhv3",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: .env read through a symlink outside the project can expose the CI job\u0027s environment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123368",
    "datePublished": "2026-11-09T17:25:15.559Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:25:15.559Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125125 (GCVE-0-2026-125125)

Vulnerability from cvelistv5 – Published: 2026-11-10 16:55 – Updated: 2026-11-10 19:04

Title

compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 18:19 UTC

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.30.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125125",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:19:14.192887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:04:15.911Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.30.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:55:55.117Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-xcf7-88g6-7xr8"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xcf7-88g6-7xr8",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action\u0027s SARIF-directory error message"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125125",
    "datePublished": "2026-11-10T16:55:55.117Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T19:04:15.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125124 (GCVE-0-2026-125124)

Vulnerability from cvelistv5 – Published: 2026-11-10 16:53 – Updated: 2026-11-10 16:53

Title

compose-lint: Text in a pull request can reach Azure Pipelines as logging commands through compose-lint 0.31.0's output

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place that opener in a Compose value or file name, allowing output from the package, pre-commit hook, or Docker image to issue logging commands when printed to an Azure Pipelines job log. The maintainer did not reproduce the behavior on an Azure Pipelines agent. The GitHub Action is not affected because it runs only on GitHub Actions, and releases before 0.31.0 are outside this advisory because they did not claim Azure Pipelines coverage. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: = 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place that opener in a Compose value or file name, allowing output from the package, pre-commit hook, or Docker image to issue logging commands when printed to an Azure Pipelines job log. The maintainer did not reproduce the behavior on an Azure Pipelines agent. The GitHub Action is not affected because it runs only on GitHub Actions, and releases before 0.31.0 are outside this advisory because they did not claim Azure Pipelines coverage. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:53:57.148Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-m4xg-839g-24cv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-m4xg-839g-24cv"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-m4xg-839g-24cv",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Text in a pull request can reach Azure Pipelines as logging commands through compose-lint 0.31.0\u0027s output"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125124",
    "datePublished": "2026-11-10T16:53:57.148Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T16:53:57.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125123 (GCVE-0-2026-125123)

Vulnerability from cvelistv5 – Published: 2026-11-10 16:52 – Updated: 2026-11-10 21:06

Title

compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 21:06 UTC

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: = 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125123",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:06:15.458993Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:06:30.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint\u0027s argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed without a preceding -- separator. A pull request can supply a path containing workflow-command syntax; a carriage return can position that command at the start of a new line recognized by the GitHub Actions runner, allowing the package, Docker image, or a pre-commit hook with misconfigured args to issue the command in the job log. The default pre-commit configuration includes -- and is not affected, the GitHub Action is not affected, and the lint pass or fail result is unchanged. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:52:31.891Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-8v59-qmwv-4p6q"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8v59-qmwv-4p6q",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0\u0027s command-line error messages"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125123",
    "datePublished": "2026-11-10T16:52:31.891Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T21:06:30.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125122 (GCVE-0-2026-125122)

Vulnerability from cvelistv5 – Published: 2026-11-10 16:50 – Updated: 2026-11-10 16:50

Title

compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0's JSON and SARIF output on stdout

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: = 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "= 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener in a service name or other Compose value, and the GitHub Actions runner recognizes it even in the middle of a serialized line when the package, pre-commit hook, or Docker image prints JSON or SARIF to the job log. Writing the output to a file and using the compose-lint GitHub Action are not affected, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:50:46.826Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-hr4h-4c45-v4q4"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-hr4h-4c45-v4q4",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0\u0027s JSON and SARIF output on stdout"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125122",
    "datePublished": "2026-11-10T16:50:46.826Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T16:50:46.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125121 (GCVE-0-2026-125121)

Vulnerability from cvelistv5 – Published: 2026-11-10 16:43 – Updated: 2026-11-10 16:50

Title

compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/945	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/54…	x_refsource_MISC
https://github.com/advisories/GHSA-6f4g-xm8v-pgv6	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.31.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.31.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leading Unicode whitespace before interpreting a line. Untrusted Compose values or repository paths beginning with Unicode whitespace followed by :: can therefore reach the text report, fix guidance, the fix dry-run diff, and stderr diagnostics as workflow commands when the package, pre-commit hook, or Docker image runs directly in CI. The GitHub Action is not affected because it disables command processing, and the flaw does not change the lint pass or fail result. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:50:03.051Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/945"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"
        },
        {
          "name": "https://github.com/advisories/GHSA-6f4g-xm8v-pgv6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/advisories/GHSA-6f4g-xm8v-pgv6"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r7j4-crjv-h467",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0\u0027s output"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125121",
    "datePublished": "2026-11-10T16:43:01.275Z",
    "dateReserved": "2026-11-09T17:45:35.936Z",
    "dateUpdated": "2026-11-10T16:50:03.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123796 (GCVE-0-2026-123796)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:48 – Updated: 2026-11-09 17:48

Title

compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/978	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/31…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.32.0, < 0.33.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.32.0, \u003c 0.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint\u0027s incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:48:15.456Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-rm8w-w798-g545",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-rm8w-w798-g545"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/978",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/978"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/31ec460399e06e98aa0d1cc578368a1960a8a0b3"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.33.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.33.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rm8w-w798-g545",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123796",
    "datePublished": "2026-11-09T17:48:15.456Z",
    "dateReserved": "2026-11-06T15:27:56.225Z",
    "dateUpdated": "2026-11-09T17:48:15.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123373 (GCVE-0-2026-123373)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:46 – Updated: 2026-11-09 22:57

Title

compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:57 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/721	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/36…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.2.0, < 0.25.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:57:30.423283Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:57:41.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.2.0, \u003c 0.25.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:46:13.505Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/721",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/721"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.25.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.25.0"
        }
      ],
      "source": {
        "advisory": "GHSA-whr6-fgpq-fpv9",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123373",
    "datePublished": "2026-11-09T17:46:13.505Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T22:57:41.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123372 (GCVE-0-2026-123372)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:38 – Updated: 2026-11-09 17:39

Title

compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/944	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/97…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.22.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:39:27.049Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/944",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/944"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jf3h-8jvx-vcrg",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123372",
    "datePublished": "2026-11-09T17:38:24.683Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:39:27.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123371 (GCVE-0-2026-123371)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:36 – Updated: 2026-11-10 19:11

Title

compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external file fails YAML parsing. A pull request can point the policy file at a runner credential file, causing about 30 characters around an attacker-uncontrolled parse position to appear in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. The run exits with an error and the attacker cannot select the exact disclosed line, but public logs or Code Scanning output can reveal part of the target. This issue is fixed in version 0.32.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 18:17 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CWE-209 - Generation of Error Message Containing Sensitive Information

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/943	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/e8…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.2.0, < 0.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:17:53.850255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:11:49.813Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.2.0, \u003c 0.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external file fails YAML parsing. A pull request can point the policy file at a runner credential file, causing about 30 characters around an attacker-uncontrolled parse position to appear in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. The run exits with an error and the attacker cannot select the exact disclosed line, but public logs or Code Scanning output can reveal part of the target. This issue is fixed in version 0.32.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:36:29.552Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-88f4-frh5-gmcr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-88f4-frh5-gmcr"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/943",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/943"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/e80547d33b2114040c4bc0e34ef210aee51f5058",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/e80547d33b2114040c4bc0e34ef210aee51f5058"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"
        }
      ],
      "source": {
        "advisory": "GHSA-88f4-frh5-gmcr",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123371",
    "datePublished": "2026-11-09T17:36:29.552Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-10T19:11:49.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123370 (GCVE-0-2026-123370)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:34 – Updated: 2026-11-09 17:34

Title

compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

CWE

CWE-193 - Off-by-one Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/547	x_refsource_MISC
https://github.com/tmatens/compose-lint/pull/549	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/c9…	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/cb…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.9.0, < 0.18.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.9.0, \u003c 0.18.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint\u0027s YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-193",
              "description": "CWE-193: Off-by-one Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:34:24.026Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/547",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/547"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/549",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/549"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.18.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.18.0"
        }
      ],
      "source": {
        "advisory": "GHSA-65v8-q222-64xx",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: `fix --apply` can delete a line the user did not select, including a security setting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123370",
    "datePublished": "2026-11-09T17:34:24.026Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:34:24.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123369 (GCVE-0-2026-123369)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:32 – Updated: 2026-11-09 22:55

Title

compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:52 UTC

CWE

CWE-117 - Improper Output Neutralization for Logs
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/918	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/67…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: < 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:52:06.368275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:55:25.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:32:25.031Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/918",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/918"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6f4g-xm8v-pgv6",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123369",
    "datePublished": "2026-11-09T17:32:25.031Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T22:55:25.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123368 (GCVE-0-2026-123368)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:25 – Updated: 2026-11-09 17:25

Title

compose-lint: .env read through a symlink outside the project can expose the CI job's environment

Summary

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/tmatens/compose-lint/security/…	x_refsource_CONFIRM
https://github.com/tmatens/compose-lint/pull/917	x_refsource_MISC
https://github.com/tmatens/compose-lint/commit/c4…	x_refsource_MISC
https://github.com/tmatens/compose-lint/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tmatens	compose-lint	Affected: >= 0.22.0, < 0.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "compose-lint",
          "vendor": "tmatens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:25:15.559Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6wcv-rj3c-mhv3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tmatens/compose-lint/security/advisories/GHSA-6wcv-rj3c-mhv3"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/pull/917",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/pull/917"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/commit/c43204ad4dab11d54e20574a52bc4e5835246ca5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/commit/c43204ad4dab11d54e20574a52bc4e5835246ca5"
        },
        {
          "name": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6wcv-rj3c-mhv3",
        "discovery": "UNKNOWN"
      },
      "title": "compose-lint: .env read through a symlink outside the project can expose the CI job\u0027s environment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123368",
    "datePublished": "2026-11-09T17:25:15.559Z",
    "dateReserved": "2026-11-05T20:43:10.420Z",
    "dateUpdated": "2026-11-09T17:25:15.559Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

24 vulnerabilities by tmatens

CVE-2026-125125 (GCVE-0-2026-125125)

CVE-2026-125124 (GCVE-0-2026-125124)

CVE-2026-125123 (GCVE-0-2026-125123)

CVE-2026-125122 (GCVE-0-2026-125122)

CVE-2026-125121 (GCVE-0-2026-125121)

CVE-2026-123796 (GCVE-0-2026-123796)

CVE-2026-123373 (GCVE-0-2026-123373)

CVE-2026-123372 (GCVE-0-2026-123372)

CVE-2026-123371 (GCVE-0-2026-123371)

CVE-2026-123370 (GCVE-0-2026-123370)

CVE-2026-123369 (GCVE-0-2026-123369)

CVE-2026-123368 (GCVE-0-2026-123368)

CVE-2026-125125 (GCVE-0-2026-125125)

CVE-2026-125124 (GCVE-0-2026-125124)

CVE-2026-125123 (GCVE-0-2026-125123)

CVE-2026-125122 (GCVE-0-2026-125122)

CVE-2026-125121 (GCVE-0-2026-125121)

CVE-2026-123796 (GCVE-0-2026-123796)

CVE-2026-123373 (GCVE-0-2026-123373)

CVE-2026-123372 (GCVE-0-2026-123372)

CVE-2026-123371 (GCVE-0-2026-123371)

CVE-2026-123370 (GCVE-0-2026-123370)

CVE-2026-123369 (GCVE-0-2026-123369)

CVE-2026-123368 (GCVE-0-2026-123368)