CVE-2026-123373 compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-123373?
CVE-2026-123373 is a low-severity vulnerability in tmatens compose-lint, published on 9 Nov 2026.
Official description
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affects compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. If an external Compose-related target fails YAML parsing, the error quotes an attacker-uncontrolled line into standard error, JSON errors, and SARIF notifications, while an external env_file can expose credential-like key names through CL-0020 and CL-0021 findings. The attacker selects the target path but not the exact parser-failure line, values from env_file are not printed, and the pass or fail result is unchanged. This issue is fixed in version 0.25.0.
Which versions are affected by CVE-2026-123373?
2 open source packages ship an affected version, including tmatens/compose-lint and compose-lint.
| Package | Affected | Fixed in |
|---|---|---|
tmatens/compose-lint GitHub Actions | From 0.2.0 | 0.25.0 |
compose-lint PyPI | From 0.2.0 | 0.25.0 |
How do I fix CVE-2026-123373?
Upgrade tmatens/compose-lint to 0.25.0 or later.
Is CVE-2026-123373 being exploited?
There is no known exploitation of CVE-2026-123373 in the wild and no public exploit code.
Sources
Also known as GHSA-whr6-fgpq-fpv9.