Composer vulnerabilities

Products

• Composer 19

Newest

• composer MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal CVE-2026-109153 5.3 MediumOctober 13, 2026
• composer Composer: Perforce source URL permits P4PORT `rsh:` command execution CVE-2026-84361 Public exploitFix available 7.7 HighSeptember 1, 2026
• composer Composer: CVE-2026-59946 fix bypass via symlinked package bin path CVE-2026-59944 Fix available 6.1 MediumAugust 28, 2026
• composer Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) CVE-2026-59947 Fix available 4.7 MediumJuly 8, 2026
• composer Composer: Arbitrary file write outside vendor via malicious transitive package name CVE-2026-59948 Fix available 7.0 HighJuly 8, 2026
• composer Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files CVE-2026-59946 Fix available 6.1 MediumJuly 8, 2026
• composer MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2026-10043 7.8 HighJune 24, 2026
• composer Composer - Critical - Unsupported - SA-CONTRIB-2026-046 CVE-2026-11914 5.9 MediumJune 10, 2026
• composer Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs CVE-2026-45793 Fix available 7.5 HighMay 19, 2026
• composer, red hat hardened images +1 more Composer is vulnerable to Command Injection via Malicious Perforce Repository CVE-2026-40176 Public exploitFix available 7.8 HighApril 14, 2026
• composer, red hat hardened images +1 more Composer has Command Injection via Malicious Perforce Reference CVE-2026-40261 Public exploitFix available 8.8 HighApril 14, 2026
• composer Composer vulnerable to ANSI sequence injection CVE-2025-67746 Fix available 1.3 LowDecember 30, 2025
• composer, fedoraproject fedora +1 more Composer vulnerable to command injection via malicious git/hg branch names CVE-2024-35242 Public exploitFix available 8.8 HighJune 10, 2024
• composer, fedoraproject fedora +1 more Composer vulnerable to command injection via malicious git branch name CVE-2024-35241 Fix available 8.8 HighJune 10, 2024
• composer Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer CVE-2024-24821 Fix available 8.8 HighFebruary 8, 2024
• composer, debian linux, fedoraproject fedora +2 more Remote Code Execution via web-accessible composer.phar CVE-2023-43655 Fix available 6.4 MediumSeptember 29, 2023
• composer, fedoraproject fedora, tenable tenable.sc +2 more Missing input validation can lead to command execution in composer CVE-2022-24828 Fix available 8.3 HighApril 13, 2022
• composer, tenable tenable.sc +1 more Command injection in composer on Windows CVE-2021-41116 Fix available 8.2 HighOctober 5, 2021
• composer, debian linux, fedoraproject fedora +2 more Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer CVE-2021-29472 Fix available 8.8 HighApril 27, 2021
• getcomposer composer-setup, composer windows-setup +1 more Local privilege elevation in Composer-Setup for Windows CVE-2020-15145 6.7 MediumAugust 14, 2020