# CVE-2026-123370: compose-lint fix engine line break handling bypass

Source: https://junglewise.ai/threats/cve-2026-123370-compose-lint-is-a-docker-compose-security-linter-that-identifies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-123370 · Severity: medium · CVSS 4 · Published 2026-11-09

compose-lint is a security linter for Docker Compose configuration files that checks for dangerous misconfigurations. A flaw in versions 0.9.0 to 0.18.0 allows attackers to craft malicious Compose files that cause the fix --apply command to silently delete unrelated security settings from the configuration file. The attack exploits a mismatch between how the YAML parser and fix engine count line breaks, resulting in edited files that remain valid but have critical settings removed without user awareness.

Technologies: [compose-lint (PyPI)](https://junglewise.ai/threats/technologies/pypi-compose-lint). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-123370 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123370 being exploited in the wild.

**How severe is CVE-2026-123370?** Medium severity, with a CVSS score of 4, published 9 November 2026.

**Which products and versions are affected?** Compose-Lint 0.9.0 to 0.17.x; compose-lint (PyPI) >= 0.9.0, <= 0.17.0, ECOSYSTEM:introduced=0.9.0,fixed=0.18.0.

**Is there a fix for CVE-2026-123370?** Yes. compose-lint (PyPI): upgrade to 0.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123370 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-123370?** Check whether you run Compose-Lint or compose-lint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- compose-lint (PyPI): upgrade to 0.18.0 or later

  ```sh
  pip install "compose-lint>=0.18.0"
  ```


## Technical details

The vulnerability stems from a line break parsing inconsistency: the YAML parser recognizes carriage returns (\r), U+0085, U+2028, and U+2029 as line breaks, but the fix engine's byte-offset table counts only newline characters (\n). When a quoted value contains one of these alternate line separators, the offset calculation shifts by one line, causing fix --apply to splice at the wrong location and delete subsequent lines. The attack requires crafting a Compose file with one of these separators in a quoted scalar value; no authentication or user interaction beyond running fix --apply is needed.

## Affected products

- compose-lint compose-lint 0.9.0 to 0.17.x

## Identifiers

- CVE-2026-123370
- GHSA-65v8-q222-64xx

## Timeline

- 2026-11-09: disclosed
- 2026-11-09: patched: Version 0.18.0 released

## References

- [https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de](https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de)
- [https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d](https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d)

## Related threats

- [compose-lint command injection via unsanitized stderr output](https://junglewise.ai/threats/cve-2026-125123-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint CI command injection in JSON and SARIF output](https://junglewise.ai/threats/cve-2026-125122-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint workflow command injection via Unicode whitespace](https://junglewise.ai/threats/cve-2026-125121-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint information disclosure via incomplete .env remediation at finding limit](https://junglewise.ai/threats/cve-2026-123796-compose-lint-is-a-docker-compose-security-linter-that-identifies)
- [compose-lint path traversal via symlink following in Compose files](https://junglewise.ai/threats/cve-2026-123373-compose-lint-is-a-docker-compose-security-linter-that-identifies)