PT-2026-140931
CVE-2026-123370
·
Published
2026-11-09
·
Updated
2026-11-10
Description by
CVSS 4.0
5.1
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
compose-lint versions 0.9.0 through 0.17.0
Description
The YAML parser in compose-lint incorrectly handles lone carriage returns and Unicode line separators (U+0085, U+2028, and U+2029) by recognizing them as line breaks, whereas the fix position conversion only counts newline characters. An attacker can place these separators within a quoted value, causing the
fix --apply command to shift subsequent edits and delete the line following the selected target. This can lead to the unintended removal of security settings or network configurations. The resulting file may remain valid and pass post-edit checks, masking the deletion.Recommendations
Update to version 0.18.0.
Found an issue in the description? Have something to add? Feel free to write us 👾