Is CVE-2026-123373 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123373 being exploited in the wild.

How severe is CVE-2026-123373?

Medium severity, with a CVSS score of 4, published 9 November 2026.

Which products and versions are affected?

tmatens/compose-lint (GitHub Actions) >= 0.2.0, = 0.2.0, <= 0.24.0, ECOSYSTEM:introduced=0.2.0,fixed=0.25.0; Todd Matens Compose-Lint 0.2.0 to 0.24.x.

How is CVE-2026-123373 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-123373?

Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Todd Matens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123373: compose-lint path traversal via symlink following in Compose files

Q: Is there a fix for CVE-2026-123373?

Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.25.0 or later; compose-lint (PyPI): upgrade to 0.25.0 or later. Until then: Restrict commit access to the repository or manually review pull requests that add or modify symbolic links in Compose file references, COMPOSE_FILE entries, and env_file targets before merge. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-123373 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-123373?

Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Todd Matens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123373 · Severity: medium · CVSS 4 · Published 2026-11-09

compose-lint is a Docker Compose security linter that checks configurations before deployment. Versions 0.2.0 through 0.24.x follow symbolic links in Compose file references without verifying they stay within the project directory, allowing attackers to read arbitrary files on the host system and expose credentials or file contents in scan reports.

Technologies: tmatens/compose-lint (GitHub Actions), compose-lint (PyPI). Vendors: GitHub Actions, PyPI.

Quick answers

Is CVE-2026-123373 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123373 being exploited in the wild.
How severe is CVE-2026-123373?: Medium severity, with a CVSS score of 4, published 9 November 2026.
Which products and versions are affected?: tmatens/compose-lint (GitHub Actions) >= 0.2.0, <= 0.24.0, ECOSYSTEM:introduced=0.2.0,fixed=0.25.0|GIT:introduced=60c091c7cc8f86c6b0c5954031097364fea0a201,fixed=cb12b5313ff1fb182ff3c832b41ff3d574a68c6b; compose-lint (PyPI) >= 0.2.0, <= 0.24.0, ECOSYSTEM:introduced=0.2.0,fixed=0.25.0; Todd Matens Compose-Lint 0.2.0 to 0.24.x.
Is there a fix for CVE-2026-123373?: Yes. tmatens/compose-lint (GitHub Actions): upgrade to 0.25.0 or later; compose-lint (PyPI): upgrade to 0.25.0 or later. Until then: Restrict commit access to the repository or manually review pull requests that add or modify symbolic links in Compose file references, COMPOSE_FILE entries, and env_file targets before merge. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123373 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-123373?: Check whether you run tmatens/compose-lint (GitHub Actions), compose-lint (PyPI) or Todd Matens Compose-Lint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tmatens/compose-lint (GitHub Actions): upgrade to 0.25.0 or later
compose-lint (PyPI): upgrade to 0.25.0 or later
```
pip install "compose-lint>=0.25.0"
```

Restrict commit access to the repository or manually review pull requests that add or modify symbolic links in Compose file references, COMPOSE_FILE entries, and env_file targets before merge.

Technical details

The vulnerability is a path traversal flaw in how compose-lint validates env_file targets and COMPOSE_FILE entries. The tool performs only lexical (document-level) checks to ensure paths appear project-relative, but does not verify the actual filesystem resolution; a committed symlink passes the lexical test while pointing anywhere on the runner. This allows an attacker to commit a symlink to an out-of-project file (e.g., /home/runner/.aws/credentials), causing compose-lint to read it and expose key names via CL-0020/CL-0021 findings or arbitrary file content in SARIF/JSON output. Additionally, YAML parse errors quote source lines verbatim, republishing credentials if a syntax error occurs on a line containing them.

Affected products

Todd Matens compose-lint 0.2.0 to 0.24.x

Identifiers

CVE-2026-123373
GHSA-whr6-fgpq-fpv9

Timeline

2026-11-09: disclosed
2026-08-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.