{"id":"CVE-2026-123370","kind":"vulnerability","aliases":["CVE-2026-123370"],"related":[],"title":"compose-lint: line-break handling bug lets a pull request delete config lines","description":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.","summary":"compose-lint is a linter for Docker Compose files that flags risky settings. A crafted pull request can place a special line-break character in a quoted value, so the fix --apply command deletes an unrelated line after the target, possibly removing a network or security setting.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","compose-lint","docker-compose","package"],"not_affected_if":["check-only-usage","version-0.18.0-or-later"],"how_to_check":"- Check the installed compose-lint version with `compose-lint --version` or the package manifest; versions before `0.18.0` from `0.9.0` are affected.\n- Look in CI pipelines for compose-lint running `fix --apply` against files from pull requests.","fix":"- compose-lint: move to `0.18.0`","status":"open","published_at":"2026-11-09T18:17:25+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","triaged_at":"2026-11-09T18:29:21+00:00","updated_at":"2026-11-09T18:29:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T18:29:21Z","model":"claude-haiku-5-5","output":{"fix":"- compose-lint: move to `0.18.0`","reach":"internet","title":"compose-lint: line-break handling bug lets a pull request delete config lines","impact":"medium","summary":"compose-lint is a linter for Docker Compose files that flags risky settings. A crafted pull request can place a special line-break character in a quoted value, so the fix --apply command deletes an unrelated line after the target, possibly removing a network or security setting.","audience":"developers","category":"package","nicknames":[],"who_cares":["docker-compose","compose-lint","ci"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"a security setting in a Compose file is silently deleted","analyst_note":"","how_to_check":"- Check the installed compose-lint version with `compose-lint --version` or the package manifest; versions before `0.18.0` from `0.9.0` are affected.\n- Look in CI pipelines for compose-lint running `fix --apply` against files from pull requests.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["check-only-usage","version-0.18.0-or-later"],"who_is_affected":"Teams that run compose-lint's fix --apply on Docker Compose files, especially in CI on untrusted pull requests, where a crafted line break can remove a security setting without an obvious error. Teams that only run the linter in check mode, or do not use the fix command, are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000746,"input_tokens":4748,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'+0085':113C '+2028':115C '+2029':118C '-123370':18A,21A '-2026':17A,20A '0.18.0':97C,208C '0.9.0':95C 'appli':63B,145C 'break':6A,54B,121C 'bug':8A 'carriag':106C 'charact':55B,129C 'check':176C 'ci':22B 'command':64B,181C 'compos':2A,24B,28B,31B,38B,80C,85C,99C,168C 'compose-lint':1A,23B,30B,79C,98C 'config':14A 'convers':125C 'count':126C 'craft':45B 'cve':16A,19A 'danger':90C 'delet':13A,65B,151C,201C 'deploy':93C 'diff':193C 'docker':27B,37B,84C 'docker-compos':26B 'dri':191C 'dry-run':190C 'edit':149C,175C 'even':187C 'extra':200C 'file':39B,169C 'fix':62B,123C,144C,186C,205C 'flag':41B 'handl':7A 'identifi':89C 'includ':158C 'issu':203C 'later':148C 'let':9A 'line':5A,15A,53B,68B,110C,120C,153C 'line-break':4A,52B 'lint':3A,25B,32B,81C,100C 'linter':35B,87C 'lone':105C 'misconfigur':91C 'network':75B,161C 'newlin':128C 'one':135C 'packag':29B 'parser':103C 'pass':178C 'place':49B,134C,197C 'posit':124C 'possibl':72B 'post':174C 'post-edit':173C 'pull':11A,46B,131C 'quot':58B,141C 'recogn':104C 'remain':171C 'remov':73B 'report':183C 'request':12A,47B,132C 'result':167C 'return':107C 'riski':42B 'run':192C 'secur':77B,86C,164C 'select':156C 'separ':111C,138C 'set':43B,78B,165C 'shift':146C 'show':198C 'special':51B 'success':185C 'target':71B,157C 'though':188C 'u':112C,114C,117C 'unicod':109C 'unrel':67B 'unselect':160C 'valid':172C 'valu':59B,142C 'version':207C 'yaml':102C","nicknames":[],"mitigations":[],"who_affected":"Teams that run compose-lint's fix --apply on Docker Compose files, especially in CI on untrusted pull requests, where a crafted line break can remove a security setting without an obvious error. Teams that only run the linter in check mode, or do not use the fix command, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","composelint","dockercompose","medium","package"],"campaign_type":null,"search_a":"'-123370':18A,21A '-2026':17A,20A 'break':6A 'bug':8A 'compos':2A 'compose-lint':1A 'config':14A 'cve':16A,19A 'delet':13A 'handl':7A 'let':9A 'line':5A,15A 'line-break':4A 'lint':3A 'pull':11A 'request':12A","search_b":"'appli':63B 'break':54B 'charact':55B 'ci':22B 'command':64B 'compos':24B,28B,31B,38B 'compose-lint':23B,30B 'craft':45B 'delet':65B 'docker':27B,37B 'docker-compos':26B 'file':39B 'fix':62B 'flag':41B 'line':53B,68B 'line-break':52B 'lint':25B,32B 'linter':35B 'network':75B 'packag':29B 'place':49B 'possibl':72B 'pull':46B 'quot':58B 'remov':73B 'request':47B 'riski':42B 'secur':77B 'set':43B,78B 'special':51B 'target':71B 'unrel':67B 'valu':59B","search_c":"'+0085':113C '+2028':115C '+2029':118C '0.18.0':97C,208C '0.9.0':95C 'appli':145C 'break':121C 'carriag':106C 'charact':129C 'check':176C 'command':181C 'compos':80C,85C,99C,168C 'compose-lint':79C,98C 'convers':125C 'count':126C 'danger':90C 'delet':151C,201C 'deploy':93C 'diff':193C 'docker':84C 'dri':191C 'dry-run':190C 'edit':149C,175C 'even':187C 'extra':200C 'file':169C 'fix':123C,144C,186C,205C 'identifi':89C 'includ':158C 'issu':203C 'later':148C 'line':110C,120C,153C 'lint':81C,100C 'linter':87C 'lone':105C 'misconfigur':91C 'network':161C 'newlin':128C 'one':135C 'parser':103C 'pass':178C 'place':134C,197C 'posit':124C 'post':174C 'post-edit':173C 'pull':131C 'quot':141C 'recogn':104C 'remain':171C 'report':183C 'request':132C 'result':167C 'return':107C 'run':192C 'secur':86C,164C 'select':156C 'separ':111C,138C 'set':165C 'shift':146C 'show':198C 'success':185C 'target':157C 'though':188C 'u':112C,114C,117C 'unicod':109C 'unselect':160C 'valid':172C 'valu':142C 'version':207C 'yaml':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-28T00:34:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123370","severity":null,"published_at":"2026-11-09T18:17:25+00:00","modified_at":"2026-11-09T18:17:25+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","fetched_at":"2026-11-09T18:27:56+00:00","note":null}],"documents":[{"id":108797,"url":"https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108798,"url":"https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108799,"url":"https://github.com/tmatens/compose-lint/releases/tag/v0.18.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":108800,"url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-28T00:34:17+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}