Compose‑lint processes a .compose‑lint.yml policy file and, when that file contains a symbolic link to a location outside the repository, the linter follows the link and reports parse errors that include about 30 characters around the error position. This leaks fragments of the target file’s path, potentially exposing references to sensitive files such as runner credentials. The vulnerability is a form of exposure of sensitive information (CWE‑209) and local file inclusion (CWE‑59), and the disclosed path fragments can be seen in standard error, JSON error messages, and in SARIF reports that GitHub Actions publishes.

Vendors affected are tmatens:compose‑lint. Versions from 0.2.0 through 0.32.0 are vulnerable. Users who run compose‑lint in that range, especially within GitHub Actions pipelines, are impacted. The issue was fixed in release 0.32.0; later versions are not affected.

The CVSS score of 2.3 indicates a low severity risk. The EPSS score is not available, suggesting limited or uncertain exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the exploit requires the attacker to supply or modify a .compose‑lint.yml file pointing to an external path, it is most likely a local or repository‑level attack, with the potential for sensitive path disclosure via publicly visible GitHub Action logs.