{"id":"GHSA-whr6-fgpq-fpv9","summary":"compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output","details":"### Impact\n\nLike Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from *outside* the project into its output, where the author of a pull request can read it.\n\nA pull request can commit a symlink, under a name compose-lint reads, pointing at a file on the CI runner:\n\n- **The Compose file itself (0.2.0–0.24.0).** A `compose.yml` that is a symlink, whether the pre-commit hook passes its name or the Action or a bare run finds it.\n- **`compose.override.yml` (0.22.0–0.24.0),** which compose-lint merges automatically.\n- **A `COMPOSE_FILE` entry (0.22.0–0.24.0)** in a `.env` beside the Compose file.\n\nWhen the target is not valid YAML, the parse error quotes the line it failed on. Docker Compose, given the same file, reports only a line number. That line reaches standard error (the job log), JSON `errors[]`, and the SARIF `toolExecutionNotifications`, which the Action uploads to Code Scanning.\n\nA fourth route: from 0.23.0, a symlinked `env_file:` target makes CL-0020 and CL-0021 report the credential-like **key names** in a file outside the project. Values are not printed.\n\nWhat can be read is one line of a file chosen by path, at the point where the YAML parser fails, which the attacker cannot choose; or key names. A symlink to `/proc/self/environ` gave neither in testing. The pass/fail result is not affected. On a public repository the job log is visible to the pull request's author.\n\nFound during an internal pre-1.0 security review.\n\n**GitHub Action.** Action tags v0.18.0 through v0.24.0 install their own compose-lint version and are affected. Earlier tags install the newest release unless `version:` is set; they were affected while that was 0.24.0 or earlier.\n\n**Docker image.** `composelint/compose-lint` tags 0.3.3 through 0.24.0, and the matching minor tags, are affected. Inside the container a symlink resolves within the container, so what can be read is the container's own files and anything mounted into it. Fixed from `0.25.0`.\n\n### Patches\n\nFixed in 0.25.0. Parse errors no longer quote the source line; the error and its line and column are kept. `env_file:` targets and `COMPOSE_FILE` entries that resolve outside the project are also refused, with the existing outside-the-project note. Symlinks that stay inside the project still work.\n\nFrom 0.25.0 through 0.31.0, a committed symlink to a target that is itself a Compose file could still be read, and its values could reach findings. 0.32.0 stops following a discovered, named or override Compose file whose link leaves the checkout.\n\nA related gap for the sibling `.env` file is covered by GHSA-6wcv-rj3c-mhv3, and one for a symlinked `.compose-lint.yml` by GHSA-88f4-frh5-gmcr.\n\n### Workarounds\n\n- Upgrade to 0.25.0 or later.\n- On older versions, don't run compose-lint on untrusted pull requests on a machine whose files outside the checkout hold credentials. `--no-env` closes the `COMPOSE_FILE` and `env_file:` routes, but not the others.\n\n### Reproduction\n\n```\nproject/compose.yml -\u003e /path/outside/project/credentials   (symlink)\n```\n\n`compose-lint --format sarif compose.yml` on 0.24.0 exits 2, and the SARIF notification quotes a line of the linked file. On 0.25.0 the error gives only the line and column.","aliases":["CVE-2026-123373"],"modified":"2026-11-10T16:15:04.766694252Z","published":"2026-11-10T15:57:10Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-11-10T15:57:10Z","nvd_published_at":"2026-11-09T18:17:26Z","cwe_ids":["CWE-209","CWE-59"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-whr6-fgpq-fpv9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123373"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/721"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/364814329417dbbc34d1ad2f3981f8a7a023799e"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.25.0"}],"affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.25.0"}]}],"versions":["0.10.0","0.11.0","0.12.0","0.12.1","0.12.2","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.20.0","0.21.0","0.22.0","0.23.0","0.24.0","0.3.0","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.8.0","0.9.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.24.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-whr6-fgpq-fpv9/GHSA-whr6-fgpq-fpv9.json"}},{"package":{"name":"tmatens/compose-lint","ecosystem":"GitHub Actions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.25.0"}]},{"type":"GIT","repo":"https://github.com/tmatens/compose-lint","events":[{"introduced":"60c091c7cc8f86c6b0c5954031097364fea0a201"},{"fixed":"cb12b5313ff1fb182ff3c832b41ff3d574a68c6b"}]}],"versions":["v0.24.0","v0.23.0","v0.22.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","v0.15.2","v0.15.1","v0.15.0","v0.14.1","v0.14.0","v0.13.0","v0.12.2","v0.12.1","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.1","v0.7.0","v0.6.0","v0.5.2","v0.5.1","v0.5.0","v0.4.1","v0.4.0","v0.3.7","v0.3.6","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 0.24.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-whr6-fgpq-fpv9/GHSA-whr6-fgpq-fpv9.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}