Composer vulnerabilities

A vulnerability in Composer, a dependency manager for PHP, allows disclosure of GitHub OAuth tokens in error logs. Token validation using a regex rejects GITHUB_TOKEN values containing '-', and the rejected token is interpolated into an exception message, leading to leakage to stderr or CI logs.

A vulnerability in the Composer dependency manager for PHP allows an attacker to write files outside the vendor directory and project during package installation or update. The issue occurs when a package from an untrusted repository (other than Packagist.org or Private Packagist) uses an invalid name that is not properly validated before dependency-resolution results are written.

Composer, a dependency manager for PHP, prior to versions 2.2.29 and 2.10.2 leaked credentials (e.g., GitHub tokens) to debug output when run with -vvv verbosity. The issue was due to missing sanitization of username-only URL credentials.

A vulnerability in the Composer dependency manager for PHP allows changing permissions of an existing host file to world-readable and world-executable. The issue occurs during package install, update, or require when a package bin entry contains '..' path segments.

Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed.

Command injection vulnerability in the Perforce::generateP4Command() method in Composer, a dependency manager for PHP. An attacker can inject arbitrary commands through Perforce connection parameters (port, user, client) in a malicious composer.json, leading to command execution in the context of the user running Composer.