CVE-2026-123796

Name of the Vulnerable Software and Affected Versions compose-lint versions 0.32.0 through 0.32.x

Description An incomplete remediation for .env secret disclosure occurs when the tool checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request combining a secret-referencing image field with aliased content that exceeds 20,000 findings can trigger an early-stop path. This results in the emission of graded findings containing the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into a sibling .env file and lints untrusted changes.

Recommendations Update to version 0.33.0.