{"id":"CVE-2026-123373","published":"2026-11-09T18:17:26.467","lastModified":"2026-11-09T23:17:15.360","description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-59","CWE-209"],"vendors":[],"products":[],"references":[{"url":"https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e","tags":[]},{"url":"https://github.com/tmatens/compose-lint/pull/721","tags":[]},{"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.25.0","tags":[]},{"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9","tags":[]}],"exploitRefs":[{"url":"https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e","tags":[]},{"url":"https://github.com/tmatens/compose-lint/pull/721","tags":[]},{"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.25.0","tags":[]},{"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9","tags":[]}],"hasPoc":true,"ai":null}