10 Total advisories
10 Vulnerabilities
0 Malware
Dependency scanning
Check whether compose-lint is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Vulnerabilities
UNKNOWN
CVE-2026-125123
compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages
UNKNOWN
CVE-2026-125122
compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout
UNKNOWN
CVE-2026-125121
compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
UNKNOWN
CVE-2026-123796
compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
LOW 3.1
CVE-2026-123368
compose-lint: .env read through a symlink outside the project can expose the CI job's environment
UNKNOWN
CVE-2026-123370
compose-lint: `fix --apply` can delete a line the user did not select, including a security setting
MEDIUM 4.3
CVE-2026-123369
compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
UNKNOWN
CVE-2026-123373
compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
UNKNOWN
CVE-2026-123372
compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings
UNKNOWN
CVE-2026-123371
compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target
Browse more PyPI advisories
Learn What is SAST?
Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →
Ready to move
Start Securing
Free, no credit card | First findings in minutes