compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NAssessment vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NSeverity
low2.3CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Package fixes recorded
Fix versions are recorded for 2 of 2 mapped packages. Check each release branch and any separate product guidance.
What this means
Compose-lint versions 0.2.0 through 0.24.0 may read files outside the project when a committed symlink is present, potentially exposing sensitive information. An attacker with access to the CI runner can create a symlink to read specific files. The impact is limited to reading one line of a file or key names.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Attack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
tmatens · GitHub_M
compose-lint
1 range
tmatens · GitHub_M
compose-lint
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 0.2.0, < 0.25.0
Other versions: unknown
Packages
Compare each installed version with the publisher’s affected ranges. Where a fix is recorded, choose the appropriate release branch and test compatibility before upgrading.
| Affected range | Recorded fix |
|---|---|
| From 0.2.0 before 0.25.0Ecosystem versions | 0.25.0 |
Version evidence: OSV · GHSA-whr6-fgpq-fpv9
View original version evidence (38 explicit versions)
| Affected range | Recorded fix |
|---|---|
| From 0.2.0 before 0.25.0Ecosystem versions | 0.25.0 |
| From 60c091c7cc8f86c6b0c5954031097364fea0a201 before cb12b5313ff1fb182ff3c832b41ff3d574a68c6bGit commits | cb12b5313ff1fb182ff3c832b41ff3d574a68c6b |
Version evidence: OSV · GHSA-whr6-fgpq-fpv9
View original version evidence (38 explicit versions)
What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
Use the recorded fix for your release branch. Review the publisher’s instructions and test compatibility before upgrading.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
Impact
Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from outside the project into its output, where the author of a pull request can read it.
A pull request can commit a symlink, under a name compose-lint reads, pointing at a file on the CI runner:
- The Compose file itself (0.2.0–0.24.0). A
compose.ymlthat is a symlink, whether the pre-commit hook passes its name or the Action or a bare run finds it. compose.override.yml(0.22.0–0.24.0), which compose-lint merges automatically.- A
COMPOSE_FILEentry (0.22.0–0.24.0) in a.envbeside the Compose file.
When the target is not valid YAML, the parse error quotes the line it failed on. Docker Compose, given the same file, reports only a line number. That line reaches standard error (the job log), JSON errors[], and the SARIF toolExecutionNotifications, which the Action uploads to Code Scanning.
A fourth route: from 0.23.0, a symlinked env_file: target makes CL-0020 and CL-0021 report the credential-like key names in a file outside the project. Values are not printed.
What can be read is one line of a file chosen by path, at the point where the YAML parser fails, which the attacker cannot choose; or key names. A symlink to /proc/self/environ gave neither in testing. The pass/fail result is not affected. On a public repository the job log is visible to the pull request's author.
Found during an internal pre-1.0 security review.
GitHub Action. Action tags v0.18.0 through v0.24.0 install their own compose-lint version and are affected. Earlier tags install the newest release unless version: is set; they were affected while that was 0.24.0 or earlier.
Docker image. composelint/compose-lint tags 0.3.3 through 0.24.0, and the matching minor tags, are affected. Inside the container a symlink resolves within the container, so what can be read is the container's own files and anything mounted into it. Fixed from 0.25.0.
Patches
Fixed in 0.25.0. Parse errors no longer quote the source line; the error and its line and column are kept. env_file: targets and COMPOSE_FILE entries that resolve outside the project are also refused, with the existing outside-the-project note. Symlinks that stay inside the project still work.
From 0.25.0 through 0.31.0, a committed symlink to a target that is itself a Compose file could still be read, and its values could reach findings. 0.32.0 stops following a discovered, named or override Compose file whose link leaves the checkout.
A related gap for the sibling .env file is covered by GHSA-6wcv-rj3c-mhv3, and one for a symlinked .compose-lint.yml by GHSA-88f4-frh5-gmcr.
Workarounds
- Upgrade to 0.25.0 or later.
- On older versions, don't run compose-lint on untrusted pull requests on a machine whose files outside the checkout hold credentials.
--no-envcloses theCOMPOSE_FILEandenv_file:routes, but not the others.
Reproduction
project/compose.yml -> /path/outside/project/credentials (symlink)
compose-lint --format sarif compose.yml on 0.24.0 exits 2, and the SARIF notification quotes a line of the linked file. On 0.25.0 the error gives only the line and column.
References
6 sourcesInside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-123373View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changes- CVE · CVE-2026-123373
Observed 2026-11-09T23:01:06.141Z · upstream updated 2026-11-09T22:57:41.567Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-11-09T22:57:30.423283Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.