CVE-2026-123373

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0.

• CWE-59
• CWE-209

• https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e
• https://github.com/tmatens/compose-lint/pull/721
• https://github.com/tmatens/compose-lint/releases/tag/v0.25.0
• https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123367Thor Vector Graphics (ThorVG) is a production-ready vector g…7.4
• CVE-2026-123368compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-123369compose-lint is a Docker Compose security linter that identi…5.3
• CVE-2026-123370compose-lint is a Docker Compose security linter that identi…5.1
• CVE-2026-123371compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-123372compose-lint is a Docker Compose security linter that identi…2.3
• CVE-2026-123374Deserialization of Untrusted Data vulnerability in Apache Ro…
• CVE-2026-123375Stack-based buffer overflow in Microsoft Office Outlook allo…8.8
• CVE-2026-123376Heap-based buffer overflow in Microsoft Office Outlook allow…8.8
• CVE-2026-123377Heap-based buffer overflow in Microsoft Office Outlook allow…8.8
• CVE-2026-123378Integer overflow or wraparound in Microsoft Office Outlook a…7.5
• CVE-2026-123379Heap-based buffer overflow in Microsoft Office Outlook allow…7.5