The vulnerability occurs when compose‑lint processes a Docker Compose file that triggers more than 20,000 findings. During the early‑stop path the linter emits already graded findings that contain the resolved secret value, exposing sensitive data in the linter’s text, JSON, SARIF, and Code Scanning outputs. This flaw allows an attacker who can influence the linted content to expose secrets that were stored in a CI‑generated .env file, constituting a confidentiality breach consistent with CWE‑200 and CWE‑532. The disclosure would allow an adversary to read any secrets persisted in the .env during the lint run, potentially revealing API keys, passwords, or other credential material.

The issue affects users of the tmatens:compose‑lint tool from version 0.32.0 up to, but excluding, 0.33.0. The vendor’s security advisory and pull request indicate that the fix is incorporated in release 0.33.0. Anyone running compose‑lint 0.32.x on a repository that contains a CI‑generated .env through which secrets are written is potentially vulnerable.

The CVSS score of 2.3 demonstrates a low severity, and the EPSS score is not available, indicating no known widespread exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to have influence over the CI environment that writes secrets into a sibling .env and to trigger a lint run that exceeds the 20,000‑finding threshold. In practice, this means the vulnerability is largely restricted to obtaining access to internal CI logs and outputs, and mitigated by proper secret management and lint configuration.