- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 10 · 3 medium, 7 low
- Registry
- PyPI
Advisories 10
- CVE-2026-125123Low 2.3
compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages
Affected: from 0.31.0, fixed in 0.32.0.
- CVE-2026-125122Low 2.3
compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0's JSON and SARIF output on stdout
Affected: from 0.31.0, fixed in 0.32.0.
- CVE-2026-125121Medium 5.3
compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
Affected: from 0.31.0, fixed in 0.32.0.
- CVE-2026-123796Low 2.3
compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
Affected: from 0.32.0, fixed in 0.33.0.
- CVE-2026-123373Low 2.3
compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
Affected: from 0.2.0, fixed in 0.25.0.
- CVE-2026-123372Low 2.3
compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings
Affected: from 0.22.0, fixed in 0.32.0.
- CVE-2026-123371Low 2.3
compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target
Affected: from 0.2.0, fixed in 0.32.0.
- CVE-2026-123370Medium 5.1
compose-lint: `fix --apply` can delete a line the user did not select, including a security setting
Affected: from 0.9.0, fixed in 0.18.0.
- CVE-2026-123369Medium 5.3
compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
Affected: fixed in 0.31.0.
- CVE-2026-123368Low 2.3
compose-lint: .env read through a symlink outside the project can expose the CI job's environment
Affected: from 0.22.0, fixed in 0.31.0.