{"affected":[{"product":"compose-lint","source":"CNA: GitHub_M","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.9.0, < 0.18.0"}]},{"ecosystem":"pip","packageName":"compose-lint","product":"compose-lint","source":"GitHub GHSA-65v8-q222-64xx","vendor":"","versions":[{"status":"affected","version":">= 0.9.0, <= 0.17.0","versionType":"GitHub advisory range"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"compose-lint","product":"compose-lint","source":"OSV GHSA-65v8-q222-64xx","vendor":"","versions":[{"status":"affected","version":"0.10.0","versionType":"PyPI"},{"status":"affected","version":"0.11.0","versionType":"PyPI"},{"status":"affected","version":"0.12.0","versionType":"PyPI"},{"status":"affected","version":"0.12.1","versionType":"PyPI"},{"status":"affected","version":"0.12.2","versionType":"PyPI"},{"status":"affected","version":"0.13.0","versionType":"PyPI"},{"status":"affected","version":"0.14.0","versionType":"PyPI"},{"status":"affected","version":"0.14.1","versionType":"PyPI"},{"status":"affected","version":"0.15.0","versionType":"PyPI"},{"status":"affected","version":"0.15.1","versionType":"PyPI"},{"status":"affected","version":"0.15.2","versionType":"PyPI"},{"status":"affected","version":"0.16.0","versionType":"PyPI"},{"status":"affected","version":"0.17.0","versionType":"PyPI"},{"status":"affected","version":"0.9.0","versionType":"PyPI"},{"events":[{"introduced":"0.9.0"},{"fixed":"0.18.0"}],"status":"unknown","version":"0.9.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-123370","cwes":["CWE-193"],"description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.","epss":{"date":"2026-11-13","percentile":0.26559,"score":0.0033},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"}],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","version":"4.0"},{"score":5.1,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794620691834,"publishedAt":1794245664026,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/pull/547"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/pull/549"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.18.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/pull/547"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/pull/549"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.18.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-65v8-q222-64xx"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-65v8-q222-64xx"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-65v8-q222-64xx","text":"compose-lint (pip): GitHub reports patched versions 0.18.0. Check the advisory for the affected release branch.","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"},{"kind":"fix","source":"OSV GHSA-65v8-q222-64xx","text":"compose-lint (PyPI): OSV reports a fixed version 0.18.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-65v8-q222-64xx"}],"revision":"1a357d7e7152d4dde9335583138bf0357b91dd8ab85293604af233a4ba71ab4e","sources":[{"modifiedAt":1794620691834,"name":"CNA: GitHub_M","retrievedAt":1794622104509,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123370"},{"modifiedAt":1794521931470,"name":"NVD","retrievedAt":1794529164546,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123370"},{"modifiedAt":1794245614000,"name":"GitHub Security Advisories","retrievedAt":1794445510908,"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx"},{"modifiedAt":1794327305145,"name":"OSV / GitHub Security Advisories","retrievedAt":1794622105024,"url":"https://osv.dev/vulnerability/GHSA-65v8-q222-64xx"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794622126819,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-123370"}],"ssvc":{"assessedAt":1794620664489,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"compose-lint: `fix --apply` can delete a line the user did not select, including a security setting","updatedAt":1794622126819}