CVE-2026-123373

Name of the Vulnerable Software and Affected Versions compose-lint versions 0.2.0 through 0.24.0

Description The software follows project-controlled symbolic links used as the Compose file outside the project. This behavior also affects compose.override.yml, COMPOSE FILE entries, and env file targets. If an external Compose-related target fails YAML parsing, an attacker-uncontrolled line may be quoted in standard error, JSON errors, and SARIF notifications. Additionally, an external env file can expose credential-like key names through specific findings. The attacker can select the target path, although they cannot control the exact parser-failure line, and values from the env file are not printed.

Recommendations Update to version 0.25.0.