CVE-2024-35241

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using --prefer-dist or the preferred-install: dist config setting.

Impact

The status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code.

Patches

2.2.24 for 2.2 LTS or 2.7.7 for mainline

Workarounds

Avoid installing dependencies via git by using --prefer-dist or the preferred-install: dist config setting.

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using --prefer-dist or the preferred-install: dist config setting.

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using --prefer-dist or the preferred-install: dist config setting.

These are all security issues fixed in the php-composer2-2.7.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php-composer2 fixes the following issues:

• CVE-2024-35241: Fixed code execution when installing packages in repository with specially crafted branch names (bsc#1226181).
• CVE-2024-35242: Fixed command injection via specially crafted branch names during repository cloning (bsc#1226182).

This update for php-composer2 fixes the following issues:

• CVE-2024-35241: Fixed code execution when installing packages in repository with specially crafted branch names (bsc#1226181).
• CVE-2024-35242: Fixed command injection via specially crafted branch names during repository cloning (bsc#1226182).

This update for php-composer2 fixes the following issues

• CVE-2026-40176: command injection via malicious Perforce repository definition (bsc#1262254).
• CVE-2026-40261: command injection via malicious Perforce source reference/url (bsc#1262255).

Changes for php-composer2:

• version update to 2.2.27 (align with upstream LTS version)

• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (246f807b, 246f807b, 246f807b)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (246f807b)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (21ffece62)
• Fixed issue handling paths with = in them on Windows (#11568)

• version 2.2.26 2025-12-30

• Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)

• version 2.2.25 2024-12-11

• Fixed deprecation notices appearing on this LTS version in case it is used on modern PHP. Modern PHP support is not guaranteed nor tested for though and the main purpose of LTS releases is legacy PHP versions support. (#12217)
• Fixed issue on plugin upgrade when it defines multiple classes (#12226)
• Fixed duplicate errors appearing in the output depending on php settings (#12214)
• Fixed InstalledVersions returning duplicate data in some instances (#12225)

• version 2.2.24 2024-06-10

• Security: Fixed command injection via malicious git branch name (GHSA-47f6-5gq3-vx9c / CVE-2024-35241)
• Security: Fixed multiple command injections via malicious git/hg branch names (GHSA-v9qv-c7wm-wgmf / CVE-2024-35242)
• Security: Fixed secure-http checks that could be bypassed by using malformed URL formats (fa3b9582c)
• Security: Fixed Filesystem::isLocalPath including windows-specific checks on linux (3c37a67c)
• Security: Fixed perforce argument escaping (3773f775)
• Security: Fixed handling of zip bombs when extracting archives (de5f7e32)
• Security: Fixed Windows command parameter escaping to prevent abuse of unicode characters with best fit encoding
• conversion (3130a7455, 04a63b324)

• version 2.2.23 2024-02-08

• Security: Fixed code execution and possible privilege escalation via compromised vendor dir contents (GHSA-7c6p-848j-wh5h / CVE-2024-24821)

• version 2.2.22 2023-09-29

• Security: Fixed possible remote code execution vulnerability if composer.phar is publicly accessible, executable as PHP, and register_argc_argv is enabled in php.ini (GHSA-jm6m-4632-36hf / CVE-2023-43655)
• Fixed authentication issue when downloading several files from private Bitbucket in parallel (#11464)
• Fixed handling of broken junctions on windows (#11550)
• Fixed loading of root aliases on path repo packages when doing partial updates (#11632)
• Fixed parsing of lib-curl-openssl version with OSX SecureTransport (#11534)
• Fixed binary proxies not being transparent when included by another PHP process and returning a value (#11454)
• Fixed support for plugin classes being marked as readonly (#11404)
• Fixed GitHub rate limit reporting (#11366)
• Fixed issue displaying solver problems with branch names containing % signs (#11359)

• version 2.2.21 2023-02-15

• Fixed extra.plugin-optional support in PluginInstaller when doing pre-install checks (#11326)

• version 2.2.20 2023-02-10

• Added extra.plugin-optional support for allow auto-disabling unknown plugins which are not critical when running non-interactive (#11315)

• version 2.2.19 2023-02-04

• Fixed URL sanitizer to handle new GitHub personal access tokens format (#11137)
• Fixed cache keys to allow _ to avoid conflicts between package names like a-b and a_b (#11229)
• Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
• Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0

• version 2.2.18 2022-08-20

• Fixed COMPOSER_NO_DEV so it also works with require and remove's --update-no-dev (#10995)
• Fixed duplicate missing extension warnings being…

This update for php-composer2 fixes the following issues:

• CVE-2026-45793: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (bsc#1271504).
• CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files (bsc#1271151).
• CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs (bsc#1271129).
• CVE-2026-59948: arbitrary file write outside vendordirectory via malicious transitive package name (bsc#1271122).

Thomas Chauchefoin discovered that Composer did not correctly handle certain arguments. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24828, CVE-2023-43655)

Ed Cradock discovered that Composer did not correctly handle the exclusion of certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-24821)

Martin Haunschmid discovered that Composer did not correctly handle git branch names. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-35241)

Maciej Piechota discovered that Composer did not correctly handle VCS branch names. An attacker could possibly use this issue to execute arbitrary code. (CVE-2024-35242)