CVE-2026-123373
Received Received - Intake

Symbolic Link Following in compose-lint

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: GitHub, Inc.

Description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123373
EUVD
EUVD-2026-120156

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tmatens compose-lint to 0.24.0 (inc)
tmatens compose-lint 0.25.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123373 is a symlink attack vulnerability in compose-lint versions 0.2.0 to 0.24.0. It allows an attacker to create a symlink pointing to a file outside the project directory. When compose-lint processes this symlink, it may include lines from the external file in error messages or SARIF reports, potentially exposing sensitive data like credentials. The issue occurs because compose-lint follows symlinks during file reading, unlike Docker Compose which only reports line numbers.

Detection Guidance

To detect this vulnerability, check the installed version of compose-lint. Run: compose-lint --version. If the version is between 0.2.0 and 0.24.0, the system is vulnerable. Additionally, inspect Docker Compose files for symlinks pointing outside the project directory.

Impact Analysis

This vulnerability could allow an attacker to expose sensitive file contents through error messages or reports generated by compose-lint. If an external file contains credentials or other sensitive information, those details might be included in outputs like SARIF notifications or JSON errors. The impact is limited as the attacker cannot control the exact line exposed and requires user interaction to trigger.

Mitigation Strategies

Upgrade compose-lint to version 0.25.0 or later. Avoid running compose-lint on untrusted pull requests. Review and remove any symlinks in project directories that point outside the project.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...