GHSA-rm8w-w798-g545: compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
compose-lintto a version that resolves this vulnerability.Fixed in 0.33.0
Event History
Frequently Asked Questions
Which CI workflows are exposed to this disclosure?
Workflows are exposed if they write secrets into a sibling .env file and run compose-lint against untrusted pull-request changes. The attacker must also be able to create content that generates more than 20,000 findings and include an image field that references a secret.
Does a stopped lint run prevent the secret from being emitted?
No. When the 20,000-finding limit is reached, the early-stop path can output already graded findings containing the resolved secret in text, JSON, SARIF, and Code Scanning output. The run exits with code 2 unless --allow-partial-coverage is used.
What version resolves the issue?
Upgrade compose-lint to version 0.33.0. The affected range is from 0.32.0 until 0.33.0.