compose-lint, a Docker Compose security linter, can read a symbolic link pointing to an external file when parsing Compose files. If that external file fails YAML parsing, compose-lint includes an attacker-controlled line in its error output to standard error, JSON error output, and SARIF notifications. Additionally, an external env_file can expose credential-like key names in findings CL-0020 and CL-0021. Because the attacker chooses the target path but not the parser-failure line, the impact is limited to the accidental disclosure of file content or key names; the linting pass or fail status remains unchanged. The vulnerability is classified as Information Exposure through logs (CWE-209) and Path Traversal/Relative Path Input (CWE-59).

The affected product is compose-lint from tmatens. Vulnerable versions are 0.2.0 through 0.24.9, including changes that affect compose.override.yml and a COMPOSE_FILE entry from 0.22.0, and an env_file target from 0.23.0. The issue is fixed in 0.25.0; later releases are not affected.

The CVSS score is 2.3, indicating low severity. EPSS is not available and the vulnerability is not listed in CISA KEV catalog. Based on the description, it is inferred that the attack vector is local: an attacker must have the ability to supply or configure a symbolic link or env_file that points to an arbitrary file accessible to the user running compose-lint. Exploitation requires only the execution of compose-lint on such a repository, and the attacker can learn the contents of the targeted file or identify credential-like keys from SARIF output. Because the vulnerability does not provide a mechanism for remote command execution or denial of service, the overall risk is low, but any sensitive data stored in external files in repositories could be leaked if compose-lint is invoked on them.