CVE-2026-123371
Received Received - Intake

compose-lint Symbolic Link Following YAML Parsing Issue

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: GitHub, Inc.

Description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project and includes part of the target line when that external file fails YAML parsing. A pull request can point the policy file at a runner credential file, causing about 30 characters around an attacker-uncontrolled parse position to appear in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. The run exits with an error and the attacker cannot select the exact disclosed line, but public logs or Code Scanning output can reveal part of the target. This issue is fixed in version 0.32.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123371
EUVD
EUVD-2026-120128

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
tmatens compose-lint to 0.32.0 (exc)
tmatens compose-lint 0.32.0
tmatens compose-lint From 0.3.3 (inc) to 0.32.0 (exc)
tmatens compose-lint to 0.31.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in compose-lint (versions 0.2.0 to 0.31.0) involves symlinked configuration files pointing outside the project directory. When a .compose-lint.yml file is a symlink to an external file and that file contains invalid YAML, error messages may include partial quotes of sensitive lines from the target file, potentially exposing credentials or other secrets in logs or CI/CD outputs.

Detection Guidance

Check if compose-lint version is between 0.2.0 and 0.31.0. Run 'compose-lint --version' to verify. Inspect GitHub Actions logs for compose-lint runs in this version range for error messages containing partial file paths or credentials. Look for symlinked .compose-lint.yml files pointing outside the project directory.

Impact Analysis

This vulnerability could expose sensitive data like credentials or file paths in public logs, GitHub Actions outputs, or Code Scanning notifications. It may also cause the tool to crash or exit with errors if external symlinks are followed. The impact is limited as the attacker cannot control the exact disclosed content.

Mitigation Strategies

Upgrade compose-lint to version 0.32.0 or later. Avoid using untrusted pull requests or configuration files. Use explicit --config paths to prevent symlink resolution. Review and restrict file access permissions in project directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...