CVE-2026-123371

Name of the Vulnerable Software and Affected Versions compose-lint versions 0.2.0 through 0.31.0

Description The software automatically follows symbolic links for the .compose-lint.yml policy file located outside the project. If the external file fails YAML parsing, the system includes a portion of the target line in the error output. An attacker can use a pull request to point the policy file toward a runner credential file, potentially exposing approximately 30 characters of the file content in standard error, JSON errors, and SARIF tool execution notifications uploaded by the GitHub Action. While the process exits with an error and the specific line cannot be precisely selected, sensitive data may be revealed through public logs or Code Scanning output.

Recommendations Update to version 0.32.0.