CVE-2026-123370 · Package
NO FIX YET · SEE WHAT TO DO
compose-lint is a linter for Docker Compose files that flags risky settings. A crafted pull request can place a special line-break character in a quoted value, so the fix --apply command deletes an unrelated line after the target, possibly removing a network or security setting.
first public Sep 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run compose-lint's fix --apply on Docker Compose files, especially in CI on untrusted pull requests, where a crafted line break can remove a security setting without an obvious error. Teams that only run the linter in check mode, or do not use the fix command, are less exposed.
Not affected if check-only-usage, version-0.18.0-or-later
Who cares ci, compose-lint, docker-compose
compose-lint --version or the package manifest; versions before 0.18.0 from 0.9.0 are affected.fix --apply against files from pull requests.0.18.0compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.