Composer vulnerabilities

Composer from 1.0 to 2.2.30 and from 2.3.0 to 2.10.3 allows a malicious or compromised dependency to bypass the earlier binary-path hardening from CVE-2026-59946. Through an in-package symlink or installed.json metadata, an attacker can point to a binary path outside the installation directory, and Composer may change the external file's permissions and create a runnable vendor/bin proxy.

Composer, a dependency manager for PHP, has a vulnerability in versions from 1.0 to 2.2.30 and 2.10.3. A malicious package from a custom repository or an untrusted composer.lock file can set source.type to perforce and source.url to a P4PORT value starting with rsh: or jsh:. When the Perforce p4 client is installed and Composer installs the package from source, p4 executes a local command with the privileges of the user or CI account.

A vulnerability in Composer, a dependency manager for PHP, allows disclosure of GitHub OAuth tokens in error logs. Token validation using a regex rejects GITHUB_TOKEN values containing '-', and the rejected token is interpolated into an exception message, leading to leakage to stderr or CI logs.

A vulnerability in the Composer dependency manager for PHP allows an attacker to write files outside the vendor directory and project during package installation or update. The issue occurs when a package from an untrusted repository (other than Packagist.org or Private Packagist) uses an invalid name that is not properly validated before dependency-resolution results are written.

Composer, a dependency manager for PHP, prior to versions 2.2.29 and 2.10.2 leaked credentials (e.g., GitHub tokens) to debug output when run with -vvv verbosity. The issue was due to missing sanitization of username-only URL credentials.

A vulnerability in the Composer dependency manager for PHP allows changing permissions of an existing host file to world-readable and world-executable. The issue occurs during package install, update, or require when a package bin entry contains '..' path segments.

Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed.

Command injection vulnerability in the Perforce::generateP4Command() method in Composer, a dependency manager for PHP. An attacker can inject arbitrary commands through Perforce connection parameters (port, user, client) in a malicious composer.json, leading to command execution in the context of the user running Composer.