CVE-2026-123373

The compose-lint security linter (versions 0.2.0 to 0.25.0 ) is vulnerable to an information disclosure issue when following project-controlled symbolic links to files outside the project directory. Specifically, if an external Compose-related target (like compose.override.yml or a COMPOSE_FILE e...

CVE-2026-123796

The compose-lint Docker Compose security linter (versions 0.32.0 to 0.33.0 ) contains a vulnerability where incomplete remediation for .env secret disclosure checks can leak sensitive information. Specifically, when a pull request combines a secret-referencing image field with aliased content pro...

CVE-2026-123371

The security linter compose-lint versions 0.2.0 through 0.32.0 is vulnerable to information disclosure. The application automatically follows symbolic links in the .compose-lint.yml policy file; if an external file fails YAML parsing, the tool includes approximately 30 characters of the target li...

CVE-2026-123372

The compose-lint security linter (versions 0.22.0 to 0.32.0 ) is vulnerable to information disclosure . The tool improperly substitutes values from a sibling .env file into image fields and quotes the resolved values in specific finding messages (CL-0004 and CL-0019 ). An attacker can exploit thi...

CVE-2026-123368

The compose-lint Docker Compose security linter is vulnerable to information disclosure in versions 0.22.0 through 0.31.0 (specifically affecting include project_directory links from 0.28.0 ). The root cause is the failure to apply containment checks when following symbolic links outside the proj...

CVE-2026-123370

The Docker Compose security linter compose-lint is vulnerable in versions 0.9.0 through 0.18.0 due to how its YAML parser handles line breaks. While the parser recognizes lone carriage returns and Unicode separators (U+0085, U+2028, U+2029) as line breaks, the fix position conversion only counts ...

CVE-2026-123369

The compose-lint Docker Compose security linter (versions prior to 0.31.0 ) is vulnerable to command injection or output manipulation because it fails to neutralize GitHub Actions and Azure Pipelines workflow-command openers. Specifically, the tool prints attacker-controlled service names, enviro...

EUVD-2026-120129

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. ...