PT-2026-140933

CVE-2026-123372

Published

2026-11-09

Updated

2026-11-10

Description by

CVSS 4.0

2.3

Low

MetricsAV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions compose-lint versions 0.22.0 through 0.31.0

Description The software substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In workflows that write secrets into the .env file and lint untrusted pull-request content, an attacker can reference a secret variable to expose its full value in job logs, JSON output, SARIF artifacts, and Code Scanning alerts. Exploitation requires a secret-bearing workflow, such as pull request target, same-repository branches, or a retained .env on a self-hosted runner.

Recommendations Update to version 0.32.0.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-532: Insertion of Sensitive Information into Log File

Related identifiers

CVE-2026-123372