Composer security advisories
Latest release 2.11.2
No open advisories.
Check your version
Type the Composer version you run to see which advisories affect it.
All Composer advisories
17 advisories, newest first.
-
medium Composer · · Reviewed
Composer: Malicious Package Can Change File Permissions Outside Vendor
Lets a malicious dependency make a file outside its own folder readable and runnable by anyone, getting around the earlier GHSA-gjfg-22fp-rrxx fix.
Fixed in 2.10.3 · 1 older release
-
high Composer · · Reviewed
Composer: Malicious Package Can Run Commands via a Perforce Source URL
Lets a malicious package run commands during composer install on machines with the p4 client, when it comes from a repository other than Packagist.org.
Fixed in 2.10.3 · 1 older release
-
medium Composer · · Reviewed
Composer: Malicious Package Can Make Private Files World-Readable
Lets a malicious dependency change permissions on files outside its folder, making private files such as SSH keys readable by other users.
Fixed in 2.10.2 · 1 older release
-
medium Composer · · Reviewed
Composer: Tokens in Repository URLs Leak Into -vvv Debug Logs
Exposes access tokens placed in the username part of a repository URL to anyone who can read Composer's -vvv debug output.
Fixed in 2.10.2 · 1 older release
-
high Composer · · Reviewed
Composer: Malicious Package Name Can Write Files Outside Vendor
Lets a malicious package from a third-party repository write files anywhere the Composer user can, which can lead to running code.
Fixed in 2.10.2 · 1 older release
-
high Composer · · Reviewed
Composer: GitHub Tokens With Hyphens Printed in Full to CI Logs
Exposes GitHub Actions GITHUB_TOKEN values, and other GitHub tokens containing a hyphen, in Composer's error output and CI logs.
Fixed in 2.9.8 and 1.10.28 · 1 older release
-
high Composer · · Reviewed
Composer: Malicious Perforce Package Metadata Can Run Commands on Install
Lets a malicious or compromised package repository run commands when Composer installs packages from source, even without Perforce installed.
Fixed in 2.9.6 · 1 older release
-
high Composer · · Reviewed
Composer: Perforce Settings in an Untrusted composer.json Can Run Commands
Lets a malicious project's composer.json run commands on your machine when you run Composer in it, even without Perforce installed.
Fixed in 2.9.6 · 1 older release
-
low Composer · · Reviewed
Composer: Remote Sources Can Inject Terminal Control Codes Into Output
Lets a source Composer downloads from inject ANSI control characters that garble Composer's terminal output.
Fixed in 2.9.3 · 1 older release
-
high Composer · · Reviewed
Composer: Malicious Git Branch Names Can Run Code on status or remove
Lets a malicious package repository run commands on your machine when you run composer status, reinstall or remove on source installs.
Fixed in 2.7.7 · 1 older release
-
high Composer · · Reviewed
Composer: Malicious Git or Hg Branch Names Can Run Code on composer install
Lets an untrusted repository run commands on your machine when you clone it and run composer install inside it.
Fixed in 2.7.7 · 1 older release
-
high Composer · · Reviewed
Composer: Tampered vendor/composer Files Run Code When Composer Runs
Lets code planted in a project's vendor/composer files run as whoever runs Composer there, including root when Composer runs with sudo.
Fixed in 2.7.0 · 1 older release
-
high Composer · · Reviewed
Composer: A Web-Accessible composer.phar Can Let Attackers Run Code
Lets an attacker run code on a server that publishes composer.phar where PHP executes it and register_argc_argv is enabled.
Fixed in 2.6.4 and 1.10.27 · 1 older release
-
high Composer ·
Missing input validation can lead to command execution in composer
Fixed in 2.3.5 and 1.10.26 · 1 older release
-
high Composer ·
Improper escaping of command arguments on Windows leading to command injection
Fixed in 2.1.9 and 1.10.23
-
high Composer ·
Fixed in 2.0.13 and 1.10.22
-
high Composer ·
Composer Cache Injection vulnerability
Fixed in 1.0.0-beta1