GHSA-jf3h-8jvx-vcrg: compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pullrequesttarget, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
compose-lintto a version that resolves this vulnerability.Fixed in 0.32.0
Event History
Frequently Asked Questions
Which CI workflows are realistically exposed to secret disclosure?
Workflows are exposed when they write secrets into a sibling .env file and run compose-lint against untrusted pull-request content. Fork pull requests normally do not receive secrets; relevant higher-risk cases include pull_request_target workflows, same-repository branches, and self-hosted runners retaining a .env file.
What must an attacker do to expose a secret?
The attacker must be able to submit pull-request content that references a secret variable in an image field. compose-lint can then resolve and quote the full value in CL-0004 or CL-0019 findings and associated fix text.
Where can the disclosed value appear?
The resolved secret can reach the CI job log, JSON output, SARIF artifacts, and Code Scanning alerts. The lint pass or fail result does not change.
How can teams identify whether they are affected?
Check whether compose-lint versions from 0.22.0 through before 0.32.0 are used in workflows that create or retain a sibling .env containing secrets while linting untrusted pull-request content. Review CL-0004 and CL-0019 findings, fix text, logs, JSON output, SARIF artifacts, and Code Scanning alerts for resolved secret values.
What version fixes the issue?
Upgrade compose-lint to version 0.32.0.