Docker Compose Security Linter Vulnerability in compose-lint by tmatens

CVE-2026-123373

What is CVE-2026-123373?

The compose-lint tool, which serves as a security linter for Docker Compose configurations, exposes a vulnerability in versions 0.2.0 through 0.25.0. This issue arises due to the handling of project-controlled symbolic links and external Compose files, including issues with compose.override.yml and specified env_file targets in related versions. If a YAML parsing error occurs, it can leak an attacker-controlled line in standard error outputs, JSON errors, and SARIF notifications. Additionally, sensitive credential-like key names from env_file handling may be exposed through specific findings, though the overall pass or fail result remains unaffected. This vulnerability has been addressed in version 0.25.0.

References