cve.bz

CVE-2026-123370

5.1 mediumEPSS 0.3%

Medium (5.1) in tmatens compose-lint. EPSS 0.3% estimated probability of exploitation activity in the next 30 days.

On this page
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.

Severity

CVSS 4.0

5.1 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
EPSS
0.3% estimated probability of exploitation activity in the next 30 days; 26th percentile. Scored 2026-11-10. A forecast for this CVE across the internet, not for your own systems.
CWE
CWE-193 Off-by-one Error
Published
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-123370 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-123370?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-123370?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-123370 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
tmatens compose-lint>= 0.9.0, < 0.18.0

References

Check your stackJSON