Compose‑Lint, a Docker Compose security linter, is vulnerable in releases 0.22.0 through 0.31.0 because it follows a sibling .env symbolic link that points outside the project directory without applying its usual containment check. When a pull request references a variable defined in the linked file, the linter substitutes that value into logs, JSON, SARIF, and Code Scanning alerts, potentially leaking the CI job’s environment data. Additionally, reading /proc/self/environ allows the entire linter process environment to be exposed, although this requires an attacker‑controlled workflow that processes untrusted changes with useful environment data; GitHub normally redacts secrets from fork PRs. The vulnerability does not alter the pass/fail status of the linter.

The flaw affects the tmatens Compose‑Lint tool. Versions 0.22.0 up to and including 0.30.x are affected; the issue is fixed in 0.31.0 and later releases. No other vendors or components are directly impacted.

The CVSS score of 2.3 classifies the vulnerability as low severity. EPSS information is not available and the issue is not listed in the CISA KEV catalogue. Exploitation requires an attacker to submit a pull request that includes a symbolic link to a .env file outside the target repository or modify an include project_directory link, and rely on CI processing of that PR. Because GitHub typically withholds secrets in forked PRs, the practical risk is limited, but the vulnerability can still expose non‑secret configuration or environment data to the log and artifact outputs.