compose-lint
PyPI10 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting compose-lintpage 1 of 1
- CVE-2026-123368LOWCVSS 2.3EG 3.1fixed in 0.31.02026-11-09
vulnerable: 0.22.0 ... 0.30.0 (9 versions)
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal con…
- CVE-2026-123369MEDIUMCVSS 5.3EG 5.3fixed in 0.31.02026-11-09
vulnerable: 0.10.0 ... 0.9.0 (44 versions)
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text wi…
- CVE-2026-123370MEDIUMCVSS 5.1EG 5.1fixed in 0.18.02026-11-09
vulnerable: 0.10.0 ... 0.9.0 (14 versions)
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028…
- CVE-2026-123371LOWCVSS 2.3EG 2.3fixed in 0.32.02026-11-09
vulnerable: 0.10.0 ... 0.9.0 (45 versions)
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project a…
- CVE-2026-123372LOWCVSS 2.3EG 2.3fixed in 0.32.02026-11-09
vulnerable: 0.22.0 ... 0.31.0 (10 versions)
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved va…
- CVE-2026-123373LOWCVSS 2.3EG 2.3fixed in 0.25.02026-11-09
vulnerable: 0.10.0 ... 0.9.0 (38 versions)
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. …
- CVE-2026-123796LOWCVSS 2.3EG 2.3fixed in 0.33.02026-11-09
vulnerable: 0.32.0
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit befo…
- CVE-2026-125121MEDIUMCVSS 5.3EG 5.3fixed in 0.32.02026-11-10
vulnerable: 0.31.0
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the run…
- CVE-2026-125122LOWCVSS 2.3EG 2.3fixed in 0.32.02026-11-10
vulnerable: 0.31.0
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --…
- CVE-2026-125123LOWCVSS 2.3EG 2.3fixed in 0.32.02026-11-10
vulnerable: 0.31.0
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when …
Check whether compose-lint is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for compose-lint CVEs against the assets you own.
Book a Demo →