CVE-2026-59947
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Composer, a dependency manager for PHP, prior to versions 2.2.29 and 2.10.2 leaked credentials (e.g., GitHub tokens) to debug output when run with -vvv verbosity. The issue was due to missing sanitization of username-only URL credentials.
Risk Assessment
Leaked access tokens in debug output could allow an attacker to access private code repositories, leading to intellectual property theft or further infrastructure compromise.
Recommendation
Immediately update Composer to version 2.2.29 or 2.10.2 (or later) and avoid running with -vvv in production environments.
Other vulnerabilities in Composer
See all- CVE-2026-45793High
A vulnerability in Composer, a dependency manager for PHP, allows disclosure of GitHub OAuth tokens in error logs. Token validation using a regex rejects GITHUB_TOKEN values containing '-', and the rejected token is interpolated into an exception message, leading to leakage to stderr or CI logs.
- CVE-2026-59948High
A vulnerability in the Composer dependency manager for PHP allows an attacker to write files outside the vendor directory and project during package installation or update. The issue occurs when a package from an untrusted repository (other than Packagist.org or Private Packagist) uses an invalid name that is not properly validated before dependency-resolution results are written.
- CVE-2026-59946Medium
A vulnerability in the Composer dependency manager for PHP allows changing permissions of an existing host file to world-readable and world-executable. The issue occurs during package install, update, or require when a package bin entry contains '..' path segments.
- CVE-2026-40261High
Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed.
- CVE-2026-40176High
Command injection vulnerability in the Perforce::generateP4Command() method in Composer, a dependency manager for PHP. An attacker can inject arbitrary commands through Perforce connection parameters (port, user, client) in a malicious composer.json, leading to command execution in the context of the user running Composer.
Original NVD description (English source)
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.