CVE-2025-67746

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

Impact

Attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application.

There is no proven exploit and this has thus a low severity but Composer still published a CVE as it has potential for abuse, and Composer wants to be on the safe side informing users that they should upgrade.

Patches

2.2.26 for 2.2 LTS or 2.9.3 for mainline.

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

These are all security issues fixed in the php-composer2-2.9.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php-composer2 fixes the following issues:

• CVE-2025-67746: ANSI control characters injection in terminal output of various Composer commands via attacker controlled remote sources (bsc#1255768).
• CVE-2026-40176: arbitrary command injection via malicious Perforce repository definition (bsc#1262254).
• CVE-2026-40261: arbitrary command injection via malicious Perforce source reference/url (bsc#1262255).

This update for php-composer2 fixes the following issues:

• CVE-2026-45793: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (bsc#1271504).
• CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files (bsc#1271151).
• CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs (bsc#1271129).
• CVE-2026-59948: arbitrary file write outside vendordirectory via malicious transitive package name (bsc#1271122).

Changes for php-composer2:

• fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).

This update for php-composer2 fixes the following issues:

CVE-2025-67746: Fixed ANSI control characters injection in the terminal output of various Composer commands via attacker controlled remote sources. (bsc#1255768)

This update for php-composer2 fixes the following issues:

CVE-2025-67746: Fixed ANSI control characters injection in the terminal output of various Composer commands via attacker controlled remote sources. (bsc#1255768)

This update for php-composer2 fixes the following issues

• CVE-2026-40176: command injection via malicious Perforce repository definition (bsc#1262254).
• CVE-2026-40261: command injection via malicious Perforce source reference/url (bsc#1262255).

Changes for php-composer2:

• version update to 2.2.27 (align with upstream LTS version)

• Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with - do not cause issues (246f807b, 246f807b, 246f807b)
• Security: Fixed Perforce unescaped user input in queryP4User shell command (246f807b)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (21ffece62)
• Fixed issue handling paths with = in them on Windows (#11568)

• version 2.2.26 2025-12-30

• Security: Fixed ANSI sequence injection (GHSA-59pp-r3rg-353g / CVE-2025-67746)

• version 2.2.25 2024-12-11

• Fixed deprecation notices appearing on this LTS version in case it is used on modern PHP. Modern PHP support is not guaranteed nor tested for though and the main purpose of LTS releases is legacy PHP versions support. (#12217)
• Fixed issue on plugin upgrade when it defines multiple classes (#12226)
• Fixed duplicate errors appearing in the output depending on php settings (#12214)
• Fixed InstalledVersions returning duplicate data in some instances (#12225)

• version 2.2.24 2024-06-10

• Security: Fixed command injection via malicious git branch name (GHSA-47f6-5gq3-vx9c / CVE-2024-35241)
• Security: Fixed multiple command injections via malicious git/hg branch names (GHSA-v9qv-c7wm-wgmf / CVE-2024-35242)
• Security: Fixed secure-http checks that could be bypassed by using malformed URL formats (fa3b9582c)
• Security: Fixed Filesystem::isLocalPath including windows-specific checks on linux (3c37a67c)
• Security: Fixed perforce argument escaping (3773f775)
• Security: Fixed handling of zip bombs when extracting archives (de5f7e32)
• Security: Fixed Windows command parameter escaping to prevent abuse of unicode characters with best fit encoding
• conversion (3130a7455, 04a63b324)

• version 2.2.23 2024-02-08

• Security: Fixed code execution and possible privilege escalation via compromised vendor dir contents (GHSA-7c6p-848j-wh5h / CVE-2024-24821)

• version 2.2.22 2023-09-29

• Security: Fixed possible remote code execution vulnerability if composer.phar is publicly accessible, executable as PHP, and register_argc_argv is enabled in php.ini (GHSA-jm6m-4632-36hf / CVE-2023-43655)
• Fixed authentication issue when downloading several files from private Bitbucket in parallel (#11464)
• Fixed handling of broken junctions on windows (#11550)
• Fixed loading of root aliases on path repo packages when doing partial updates (#11632)
• Fixed parsing of lib-curl-openssl version with OSX SecureTransport (#11534)
• Fixed binary proxies not being transparent when included by another PHP process and returning a value (#11454)
• Fixed support for plugin classes being marked as readonly (#11404)
• Fixed GitHub rate limit reporting (#11366)
• Fixed issue displaying solver problems with branch names containing % signs (#11359)

• version 2.2.21 2023-02-15

• Fixed extra.plugin-optional support in PluginInstaller when doing pre-install checks (#11326)

• version 2.2.20 2023-02-10

• Added extra.plugin-optional support for allow auto-disabling unknown plugins which are not critical when running non-interactive (#11315)

• version 2.2.19 2023-02-04

• Fixed URL sanitizer to handle new GitHub personal access tokens format (#11137)
• Fixed cache keys to allow _ to avoid conflicts between package names like a-b and a_b (#11229)
• Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
• Fixed handling of COMPOSER_DISCARD_CHANGES when set to 0

• version 2.2.18 2022-08-20

• Fixed COMPOSER_NO_DEV so it also works with require and remove's --update-no-dev (#10995)
• Fixed duplicate missing extension warnings being…

This update for php-composer2 fixes the following issues:

• CVE-2025-67746: ANSI control characters injection in terminal output of various Composer commands via attacker controlled remote sources (bsc#1255768).
• CVE-2026-40176: arbitrary command injection via malicious Perforce repository definition (bsc#1262254).
• CVE-2026-40261: arbitrary command injection via malicious Perforce source reference/url (bsc#1262255).

This update for php-composer2 fixes the following issues:

• CVE-2026-45793: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (bsc#1271504).
• CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files (bsc#1271151).
• CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs (bsc#1271129).
• CVE-2026-59948: arbitrary file write outside vendordirectory via malicious transitive package name (bsc#1271122).

Changes for php-composer2:

• fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).

This update for php-composer2 fixes the following issues:

• CVE-2026-45793: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (bsc#1271504).
• CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files (bsc#1271151).
• CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs (bsc#1271129).
• CVE-2026-59948: arbitrary file write outside vendordirectory via malicious transitive package name (bsc#1271122).

Changes for php-composer2:

• fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).

This update for php-composer2 fixes the following issues:

• CVE-2026-45793: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (bsc#1271504).
• CVE-2026-59946: path traversal in package bin field lets dependencies chmod arbitrary host files (bsc#1271151).
• CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs (bsc#1271129).
• CVE-2026-59948: arbitrary file write outside vendordirectory via malicious transitive package name (bsc#1271122).