{"affected":[{"product":"compose-lint","source":"CNA: GitHub_M","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.22.0, < 0.32.0"}]},{"ecosystem":"pip","packageName":"compose-lint","product":"compose-lint","source":"GitHub GHSA-jf3h-8jvx-vcrg","vendor":"","versions":[{"status":"affected","version":">= 0.22.0, <= 0.31.0","versionType":"GitHub advisory range"}]},{"ecosystem":"actions","packageName":"tmatens/compose-lint","product":"tmatens/compose-lint","source":"GitHub GHSA-jf3h-8jvx-vcrg","vendor":"","versions":[{"status":"affected","version":">= 0.22.0, <= 0.31.0","versionType":"GitHub advisory range"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"compose-lint","product":"compose-lint","source":"OSV GHSA-jf3h-8jvx-vcrg","vendor":"","versions":[{"status":"affected","version":"0.22.0","versionType":"PyPI"},{"status":"affected","version":"0.23.0","versionType":"PyPI"},{"status":"affected","version":"0.24.0","versionType":"PyPI"},{"status":"affected","version":"0.25.0","versionType":"PyPI"},{"status":"affected","version":"0.26.0","versionType":"PyPI"},{"status":"affected","version":"0.27.0","versionType":"PyPI"},{"status":"affected","version":"0.28.0","versionType":"PyPI"},{"status":"affected","version":"0.29.0","versionType":"PyPI"},{"status":"affected","version":"0.30.0","versionType":"PyPI"},{"status":"affected","version":"0.31.0","versionType":"PyPI"},{"events":[{"introduced":"0.22.0"},{"fixed":"0.32.0"}],"status":"unknown","version":"0.22.0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"GitHub Actions","packageName":"tmatens/compose-lint","product":"tmatens/compose-lint","source":"OSV GHSA-jf3h-8jvx-vcrg","vendor":"","versions":[{"status":"affected","version":"v0.31.0","versionType":"GitHub Actions"},{"status":"affected","version":"v0.30.0","versionType":"GitHub Actions"},{"status":"affected","version":"v0.29.0","versionType":"GitHub Actions"},{"status":"affected","version":"v0.28.0","versionType":"GitHub Actions"},{"status":"affected","version":"v0.27.0","versionType":"GitHub Actions"},{"status":"affected","version":"v0.26.0","versionType":"GitHub Actions"},{"status":"affected","version":"v0.25.0","versionType":"GitHub Actions"},{"status":"affected","version":"v0.24.0","versionType":"GitHub Actions"},{"status":"affected","version":"v0.23.0","versionType":"GitHub Actions"},{"status":"affected","version":"v0.22.0","versionType":"GitHub Actions"},{"events":[{"introduced":"0.22.0"},{"fixed":"0.32.0"}],"status":"unknown","version":"0.22.0","versionType":"ECOSYSTEM"},{"events":[{"introduced":"811ef6b379dbc78d048fcedaf976205705d4a7c3"},{"fixed":"2d42617e4c6416f797bbfc6a057950131fa02df3"}],"status":"unknown","version":"811ef6b379dbc78d048fcedaf976205705d4a7c3","versionType":"GIT"}]}],"cveId":"CVE-2026-123372","cwes":["CWE-200","CWE-532"],"description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0.","epss":{"date":"2026-11-12","percentile":0.325,"score":0.0038},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"}],"kev":null,"metrics":[{"score":2.3,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":2.3,"severity":"low","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794572974320,"publishedAt":1794245904683,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/pull/944"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/pull/944"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-jf3h-8jvx-vcrg"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-jf3h-8jvx-vcrg"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-jf3h-8jvx-vcrg","text":"compose-lint (pip): GitHub reports patched versions 0.32.0. Check the advisory for the affected release branch.","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"},{"kind":"fix","source":"GitHub GHSA-jf3h-8jvx-vcrg","text":"tmatens/compose-lint (actions): GitHub reports patched versions 0.32.0. Check the advisory for the affected release branch.","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"},{"kind":"fix","source":"OSV GHSA-jf3h-8jvx-vcrg","text":"compose-lint (PyPI): OSV reports a fixed version 0.32.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jf3h-8jvx-vcrg"},{"kind":"fix","source":"OSV GHSA-jf3h-8jvx-vcrg","text":"tmatens/compose-lint (GitHub Actions): OSV reports a fixed version 0.32.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-jf3h-8jvx-vcrg"},{"kind":"fix","source":"OSV GHSA-jf3h-8jvx-vcrg","text":"tmatens/compose-lint: OSV reports a fix at commit 2d42617e4c6416f797bbfc6a057950131fa02df3.","url":"https://github.com/advisories/GHSA-jf3h-8jvx-vcrg"}],"revision":"190a87391b800de56f979dae882266fe9f91c6263336fc69efc5e8b07f12b60e","sources":[{"modifiedAt":1794572974320,"name":"CNA: GitHub_M","retrievedAt":1794575335743,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123372"},{"modifiedAt":1794521931470,"name":"NVD","retrievedAt":1794529165078,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123372"},{"modifiedAt":1794272807000,"name":"GitHub Security Advisories","retrievedAt":1794446109559,"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"},{"modifiedAt":1794327304766,"name":"OSV / GitHub Security Advisories","retrievedAt":1794575336190,"url":"https://osv.dev/vulnerability/GHSA-jf3h-8jvx-vcrg"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794550438027,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-123372"}],"ssvc":{"assessedAt":1794572926518,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings","updatedAt":1794575336190}