CVE-2026-123370

Description

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.

Is your site exposed to CVE-2026-123370?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0033

Probability of exploitation

0.26%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-193 CWE-193

References

Other References

https://github.com/tmatens/compose-lint/commit/c9d453a6a69c076788fe1db05cb54684a616d1de https://github.com/tmatens/compose-lint/commit/cbbf886d91347dea9c51b584eb50088e70007d0d https://github.com/tmatens/compose-lint/pull/547 https://github.com/tmatens/compose-lint/pull/549 https://github.com/tmatens/compose-lint/releases/tag/v0.18.0 https://github.com/tmatens/compose-lint/security/advisories/GHSA-65v8-q222-64xx

Frequently Asked Questions

What is CVE-2026-123370? +

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.

How do I check if I'm vulnerable to CVE-2026-123370? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-40669

An off-by-one error in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to corrupt the …

CVE-2026-61469

Off-by-one error in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may …

CVE-2026-57160

PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow …

CVE-2026-88708

An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific …

CVE-2026-18460

Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from …

CVE-2026-52804

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to …