CVE-2026-125125

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression...

EUVD-2026-121405

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression...

CVE-2026-125125

The compose-lint GitHub Action (versions 0.30.0 through 0.32.0 ) is vulnerable to a command injection-like issue where a failed sarif-file subdirectory creation prints a resolved directory path without effective suppression. An attacker can submit a pull request containing a symlink to a director...

CVE-2026-125125 compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression...

CVE-2026-125122 compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0's JSON and SARIF output on stdout

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the workflow-command opener inside strings written by --format json or --format sarif to stdout. A pull request can place that opener i...

CVE-2026-125122

The compose-lint Docker Compose security linter (version 0.31.0 ) fails to sanitize the ##[ workflow-command opener within strings when using the --format json or --format sarif flags to stdout. An attacker could include this opener in a pull request via a service name or other Compose value. Whe...

electronegativity

Electronegativity ⚠️ This project has been archived ⚠️ Use ElectroNG instead! What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations,...

GHSA-RM8W-W798-G545 compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the $NAME a sibling .env filled in, instead of its value. The same release added a stop at 20,000 findings per document, and that stop is checked before the quoting step. A run that hits it reports the findings...

compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the $NAME a sibling .env filled in, instead of its value. The same release added a stop at 20,000 findings per document, and that stop is checked before the quoting step. A run that hits it reports the findings...

compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

Impact Since 0.22.0, compose-lint fills in $VAR references from the .env beside the Compose file, as Compose does. The documentation says values under environment: are never resolved from a .env, "that is where secrets live". But image: values are resolved, and CL-0004 and CL-0019 quote the...

GHSA-JF3H-8JVX-VCRG compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

Impact Since 0.22.0, compose-lint fills in $VAR references from the .env beside the Compose file, as Compose does. The documentation says values under environment: are never resolved from a .env, "that is where secrets live". But image: values are resolved, and CL-0004 and CL-0019 quote the...

compose-lint: `fix --apply` can delete a line the user did not select, including a security setting

Impact compose-lint fix --apply converts the line numbers its fixers work with into positions in the file. The YAML parser treats a lone carriage return, U+0085, U+2028 and U+2029 as line breaks, but the conversion counted only \n. One of those characters inside a quoted value, which most editors...

reposaur

Reposaur Reposaur is the open source compliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. ⚠️ before 1.0.0 expect some bugs and API changes ⚠️...

CVE-2026-123372

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. ...

CVE-2026-123373

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a...

CVE-2026-123368

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an...

CVE-2026-123372 compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. ...

CVE-2026-123368

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an...

CVE-2026-123368: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an...

CVE-2026-123373: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a...