compose-lint: .env read through a symlink outside the project can expose the CI job's environment
CVE-2026-123368
Impact compose-lint fills in ${VAR} references from the .env file next to the Compose file. It is meant to read nothing outside the project directory, and envfile:, include: and extends: paths are checked for that. The .env read is not. If .env is a symlink, compose-lint follows it wherever it points. A pull request can add a .env symlink to any file on the CI runner and a Compose file that references a variable from it. compose-lint substitutes the value and quotes it in finding messages, which go to the log and to JSON and SARIF output. The worst target is /proc/self/environ, the linter's own environment. The Compose file only needs to reference the name of the first variable in it: because that file separates variables with NUL bytes rather than newlines, the substituted value is the entire rest of the environment. On a CI runner that environment holds whatever the workflow put there, including secrets. GitHub masks registered secrets in the job log, but not in uploaded JSON or SARIF artifacts or in Code Scanning alert text. An include: entry's projectdirectory: has the same gap from 0.28.0: a directory symlink named there makes compose-lint read .env from wherever the link…
Assessment
- CVSS
- 2.3 (v4.0)
- Severity
- Low
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 10 November 2026
- Last updated
- 10 November 2026
- Affected
- compose-lint · tmatens/compose-lint
- Weakness
- CWE-22, CWE-59
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
At the source
References
- https://github.com/tmatens/compose-lint/security/advisories/GHSA-6wcv-rj3c-mhv3
- https://nvd.nist.gov/vuln/detail/CVE-2026-123368
- https://github.com/tmatens/compose-lint/pull/917
- https://github.com/tmatens/compose-lint/commit/c43204ad4dab11d54e20574a52bc4e5835246ca5
- https://github.com/tmatens/compose-lint/releases/tag/v0.31.0
- https://github.com/advisories/GHSA-6wcv-rj3c-mhv3
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-123368