compose‑lint is a Docker Compose security linter that identifies misconfigurations before deployment. From versions 0.9.0 to 0.18.0 the YAML parser interprets lone carriage returns and Unicode line separators as line breaks, but the fix –apply command counts only newline characters. When a pull request places such a separator inside a quoted value, the fix command shifts subsequent edits and inadvertently deletes the line after the selected target, including unselected network or other security settings. This bug can strip essential security configuration from the Compose file, potentially allowing insecure deployments. The weakness is an improper encoding error (CWE‑193).

Affected products are the open‑source compose‑lint tool produced by tmatens. Versions from 0.9.0 up to but not including 0.18.0 are vulnerable. The issue is resolved in release 0.18.0, so any deployment or CI pipeline that relies on earlier versions is at risk.

The CVSS score is 5.1, indicating moderate severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation is not yet documented. The likely attack vector is local or continuous‑integration usage of compose‑lint, where an attacker can craft or modify a compose file to insert a carriage return or Unicode separator within a quoted value. Running fix –apply on that file will then remove a non‑selected line, potentially degrading security. Because the flaw does not provide remote code execution or privilege escalation, the overall risk remains moderate, but the inadvertent removal of security settings can create downstream vulnerabilities.