Docker Compose Security Linter Vulnerability in Compose-Lint by Tmatens

CVE-2026-123368

What is CVE-2026-123368?

The compose-lint tool, which serves as a security linter for Docker Compose, is affected by a vulnerability that allows it to improperly follow sibling symbolic links outside the intended project directory. This issue exists in versions 0.22.0 through 0.31.0 as it does not enforce necessary containment checks, posing risks to sensitive information exposure. From version 0.28.0, the vulnerability expands to include links to project directories outside the project scope. Affected users may inadvertently expose their linter process environment through log messages and files created during execution. This exposure can occur under specific workflows that handle untrusted pull requests, despite GitHub’s guidelines to protect sensitive environment variables. The vulnerability was addressed in version 0.31.0.

References