{"id":"CVE-2026-123373","aliases":["GHSA-whr6-fgpq-fpv9"],"url":"https://o3.security/vulnerability/CVE-2026-123373","summary":"compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output","details":"### Impact\n\nLike Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from *outside* the project into its output, where the author of a pull request can read it.\n\nA pull request can commit a symlink, under a name compose-lint reads, pointing at a file on the CI runner:\n\n- **The Compose file itself (0.2.0–0.24.0).** A `compose.yml` that is a symlink, whether the pre-commit hook passes its name or the Action or a bare run finds it.\n- **`compose.override.yml` (0.22.0–0.24.0),** which compose-lint merges automatically.\n- **A `COMPOSE_FILE` entry (0.22.0–0.24.0)** in a `.env` beside the Compose file.\n\nWhen the target is not valid YAML, the parse error quotes the line it failed on. Docker Compose, given the same file, reports only a line number. That line reaches standard error (the job log), JSON `errors[]`, and the SARIF `toolExecutionNotifications`, which the Action uploads to Code Scanning.\n\nA fourth route: from 0.23.0, a symlinked `env_file:` target makes CL-0020 and CL-0021 report the credential-like **key names** in a file outside the project. Values are not printed.\n\nWhat can be read is one line of a file chosen by path, at the point where the YAML parser fails, which the attacker cannot choose; or key names. A symlink to `/proc/self/environ` gave neither in testing. The pass/fail result is not affected. On a public repository the job log is visible to the pull request's author.\n\nFound during an internal pre-1.0 security review.\n\n**GitHub Action.** Action tags v0.18.0 through v0.24.0 install their own compose-lint version and are affected. Earlier tags install the newest release unless `version:` is set; they were affected while that was 0.24.0 or earlier.\n\n**Docker image.** `composelint/compose-lint` tags 0.3.3 through 0.24.0, and the matching minor tags, are affected. Inside the container a symlink resolves within the container, so what can be read is the container's own files and anything mounted into it. Fixed from `0.25.0`.\n\n### Patches\n\nFixed in 0.25.0. Parse errors no longer quote the source line; the error and its line and column are kept. `env_file:` targets and `COMPOSE_FILE` entries that resolve outside the project are also refused, with the existing outside-the-project note. Symlinks that stay inside the project still work.\n\nFrom 0.25.0 through 0.31.0, a committed symlink to a target that is itself a Compose file could still be read, and its values could reach findings. 0.32.0 stops following a discovered, named or override Compose file whose link leaves the checkout.\n\nA related gap for the sibling `.env` file is covered by GHSA-6wcv-rj3c-mhv3, and one for a symlinked `.compose-lint.yml` by GHSA-88f4-frh5-gmcr.\n\n### Workarounds\n\n- Upgrade to 0.25.0 or later.\n- On older versions, don't run compose-lint on untrusted pull requests on a machine whose files outside the checkout hold credentials. `--no-env` closes the `COMPOSE_FILE` and `env_file:` routes, but not the others.\n\n### Reproduction\n\n```\nproject/compose.yml -> /path/outside/project/credentials   (symlink)\n```\n\n`compose-lint --format sarif compose.yml` on 0.24.0 exits 2, and the SARIF notification quotes a line of the linked file. On 0.25.0 the error gives only the line and column.","published":"2026-11-09T17:46:13.505Z","modified":"2026-11-11T02:48:44.758669653Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"GitHub Actions","name":"tmatens/compose-lint","fixedVersion":"0.25.0"},{"ecosystem":"PyPI","name":"compose-lint","fixedVersion":"0.25.0"}],"fix":{"url":"https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e","label":"tmatens/compose-lint@3648143"},"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.25.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123373.json"},{"type":"ADVISORY","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123373"},{"type":"FIX","url":"https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e"},{"type":"FIX","url":"https://github.com/tmatens/compose-lint/pull/721"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-11T02:48:44.758669653Z"}}