CVE-2026-123370 compose-lint: `fix --apply` can delete a line the user did not select, including a security setting
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123370?
CVE-2026-123370 is a medium-severity vulnerability in tmatens compose-lint, published on 9 Nov 2026.
Official description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.
Weakness: CWE-193
Which versions are affected by CVE-2026-123370?
1 open source package ship an affected version, including compose-lint.
| Package | Affected | Fixed in |
|---|---|---|
compose-lint PyPI | From 0.9.0 | 0.18.0 |
How do I fix CVE-2026-123370?
Upgrade compose-lint to 0.18.0 or later.
Is CVE-2026-123370 being exploited?
There is no known exploitation of CVE-2026-123370 in the wild and no public exploit code.
Sources
Also known as GHSA-65v8-q222-64xx.