CVE-2026-123368

Name of the Vulnerable Software and Affected Versions compose-lint versions 0.22.0 through 0.30.0

Description The software fails to apply containment checks when following sibling .env symbolic links outside the project, and from version 0.28.0, this also affects project directory links used in includes. An attacker can reference a variable from these linked files via a pull request, leading to the substitution of runner file or process-environment data into logs, JSON, SARIF artifacts, and Code Scanning alerts. Specifically, reading /proc/self/environ may expose the linter process environment because NUL-separated entries are treated as a single value.

Recommendations Update to version 0.31.0.