Composer: Malicious Git Branch Names Can Run Code on status or remove

Published as "Composer has a command injection via malicious git branch name"

high Composer · Last reviewed Nov 10, 2026

CVE: CVE-2024-35241
GHSA: GHSA-47f6-5gq3-vx9c
Packagist: PKSA-s25b-vbmp-jvhh
Reported: Jun 10, 2024

Lets a malicious package repository run commands on your machine when you run composer status, reinstall or remove on source installs.

Affected and fixed versions

In composer/composer. Find the row for the version you run, and update to the release next to it.

If you run	Update to	Support
2.3 – 2.7.6	2.7.7	Supported

Show 1 older branch, no longer supported

2.0 – 2.2.23

2.2.24

Upgrade

Run the line for the branch you are on.

composer require composer/composer:^2.7.7

What this means

A git repository with a specially crafted branch name can run commands on your machine when you run certain Composer commands. This is command injection: Composer didn't handle the branch name safely when it used it in a command.

See the Composer advisory and the fixes for 2.7 and 2.2 LTS.

Who is affected

Anyone running composer/composer with packages installed from source, meaning cloned with git instead of downloaded as an archive, who then runs composer status, composer reinstall or composer remove. The attacker needs control of the git repository one of those packages was cloned from.

Packages installed as dist archives aren't exposed, which is why the workaround below works.

What to do

Update Composer to 2.7.7, or to 2.2.24 if you're on the 2.2 LTS line. If you can't update yet, the Composer team suggests not installing dependencies from git: use --prefer-dist or set preferred-install to dist in your Composer config.

A related advisory fixed in the same releases covers composer install run inside a cloned repository with crafted branch names.

Check your app with an agent

Paste this into a coding agent that can read your project, such as Claude Code, Codex or Amp. It checks your composer.lock against the versions above and tells you what to update, without changing anything.

Check whether the PHP project you have access to is affected by this security advisory, and tell me what to update. Do a read-only check: don't edit files, don't run composer update or composer require, and don't try to reproduce the flaw.

Advisory: Composer: Malicious Git Branch Names Can Run Code on status or remove (CVE-2024-35241, GHSA-47f6-5gq3-vx9c)
Details: https://phpnews.net/security/composer/ghsa-47f6-5gq3-vx9c

Affected versions, as Composer constraints:
- composer/composer: >=2.3,<2.7.7|>=2.0,<2.2.24

Fixed releases on branches that still get security fixes:
- 2.3 – 2.7.6: update to 2.7.7

1. Find every composer.lock in the project outside vendor/ (a monorepo can have one per app) and read the installed version of each package above. Packages installed as dependencies of other packages count too.
2. Compare each installed version with its constraint: "|" separates alternative ranges, and "," means both bounds apply.
3. For each affected install, read "What this means" at https://phpnews.net/security/composer/ghsa-47f6-5gq3-vx9c and check whether the project meets the conditions it describes (a feature in use, a config value, a driver). Say which conditions you could check and which you couldn't.
4. Report a table: lock file | package | installed version | affected (yes, no or unknown) | conditions met (yes, no or unknown) | update to | evidence. For each affected package, give the command that would fix it, without running it: composer update <package> --with-dependencies when it is only installed as a dependency of another package, or composer require with the fixed version when composer.json requires it directly. If the installed version is on a branch with no fixed release listed, say it needs a move to a newer branch.

Sources

← All Composer advisories