compose-lint package vulnerabilities
Advisories affecting the compose-lint package. A list cannot tell you whether your installed version is affected — the dependency check can.
7 vulnerabilities tracked.
Check which version you are running → — this page lists advisories for the package; only a version check can tell you whether you are affected.
- 5.3 compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
- 5.1 compose-lint: `fix --apply` can delete a line the user did not select, including a security setting
- 2.3 compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
- 2.3 compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
- 2.3 compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target
- 2.3 compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings
- 2.3 compose-lint: .env read through a symlink outside the project can expose the CI job's environment
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that compose-lint is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other packages tracked here
langflow pypdf nltk next node-forge filelock PyJWT github.com/canonical/lxd github.com/labstack/echo/v4 github.com/labstack/echo/v5 vllm undici github.com/kubeflow/pipelines react-router virtualenv adminneo-org/adminneo mcp pyjwt @highcharts/dashboards authlib multer GitPython starlette highcharts