CVE-2026-123371: compose-lint information disclosure via symlink policy file

CVE-2026-123371 · Severity: medium · CVSS 4 · Published 2026-11-09

compose-lint is a Docker Compose configuration security scanner used in CI/CD pipelines. Versions 0.2.0 through 0.31.x follow symbolic links in policy files outside the project directory; a malicious pull request can point the policy file at sensitive files like CI runner credentials, causing partial contents to leak in error messages uploaded to GitHub Actions logs or Code Scanning output.

Technologies: tmatens/compose-lint (GitHub Actions), compose-lint (PyPI), Tmatens Compose-Lint. Vendors: GitHub Actions, PyPI, Tmatens.

Quick answers

Is CVE-2026-123371 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123371 being exploited in the wild.
How severe is CVE-2026-123371?
Medium severity, with a CVSS score of 4, published 9 November 2026.
Which products and versions are affected?
tmatens/compose-lint (GitHub Actions) >= 0.2.0, <= 0.31.0, ECOSYSTEM:introduced=0.2.0,fixed=0.32.0|GIT:introduced=60c091c7cc8f86c6b0c5954031097364fea0a201,fixed=2d42617e4c6416f797bbfc6a057950131fa02df3; compose-lint (PyPI) >= 0.2.0, <= 0.31.0, ECOSYSTEM:introduced=0.2.0,fixed=0.32.0; Tmatens Compose-Lint 0.2.0 through 0.31.x.
Is there a fix for CVE-2026-123371?
Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.32.0 or later; compose-lint (PyPI): upgrade to 0.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123371 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-123371?
Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Tmatens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tmatens/compose-lint (GitHub Actions): upgrade to 0.32.0 or later
  • compose-lint (PyPI): upgrade to 0.32.0 or later
    pip install "compose-lint>=0.32.0"

Technical details

The vulnerability is a symlink-following information disclosure in the .compose-lint.yml policy file discovery. When compose-lint encounters a policy file that is a symbolic link pointing outside the project directory, it attempts to parse it; if YAML parsing fails, approximately 30 characters of the target file around the parse failure point are quoted in stderr and SARIF notifications. An attacker cannot control which characters are disclosed, but public CI logs expose them anyway. The fix in 0.32.0 refuses to read policy and compose files that resolve outside their containment directories.

Affected products

  • tmatens compose-lint 0.2.0 through 0.31.x

Identifiers

  • CVE-2026-123371
  • GHSA-88f4-frh5-gmcr

Timeline

  • 2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.