What’s Vulnerable › Products

composer vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your composer version is affected

Latest composer vulnerabilities

• CVE-2026-59944 — Composer: CVE-2026-59946 fix bypass via symlinked package bin path (CVSS 6.1)
• CVE-2026-84361 — Composer: Perforce source URL permits P4PORT `rsh:` command execution (CVSS 7.7)
• CVE-2026-45793 — Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (CVSS 7.5)
• CVE-2026-59948 — Composer: Arbitrary file write outside vendor via malicious transitive package name (CVSS 7.0)
• CVE-2026-59947 — Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) (CVSS 4.7)
• CVE-2026-59946 — Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files (CVSS 6.1)
• CVE-2026-40261 — Composer has Command Injection via Malicious Perforce Reference (CVSS 8.8)
• CVE-2026-40176 — Composer is vulnerable to Command Injection via Malicious Perforce Repository (CVSS 7.8)
• CVE-2025-67746 — Composer vulnerable to ANSI sequence injection (CVSS 4.3)
• CVE-2024-35242 — Composer vulnerable to command injection via malicious git/hg branch names (CVSS 8.8)
• CVE-2024-35241 — Composer vulnerable to command injection via malicious git branch name (CVSS 8.8)
• CVE-2024-24821 — Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer (CVSS 7.8)
• CVE-2023-43655 — Remote Code Execution via web-accessible composer.phar (CVSS 8.8)
• CVE-2015-8371 — (CVSS 8.8)
• CVE-2022-24828 — Missing input validation can lead to command execution in composer (CVSS 8.8)
• CVE-2021-41116 — Command injection in composer on Windows (CVSS 9.8)
• CVE-2021-29472 — Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer (CVSS 8.8)