en
Composer is an open-source dependency manager for the PHP language. It lets projects declare required libraries, resolves compatible versions, and installs or updates them in a project-local dependency directory. The project is maintained through contributions from its authors and the broader PHP community.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScanAs of 09/15/2026, composer recorded 5 security vulnerabilities in the last 90 days across 1 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, composer had the most security vulnerabilities in the composer ecosystem, with 5 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-84361Composer: Perforce source URL permits P4PORT `rsh:` command execution | Exploitation statusNot known exploited | FixYes | Affected productcomposer | Published09/01/2026 | SeverityHigh |
CVE-2026-45793Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs | Exploitation statusNot known exploited | FixYes | Affected productcomposer | Published07/15/2026 | SeverityHigh |
CVE-2026-59947Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) | Exploitation statusNot known exploited | FixYes | Affected productcomposer | Published07/08/2026 | SeverityMedium |
CVE-2026-59948Composer: Arbitrary file write outside vendor via malicious transitive package name | Exploitation statusNot known exploited | FixYes | Affected productcomposer | Published07/08/2026 | SeverityHigh |
CVE-2026-59946Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files | Exploitation statusNot known exploited | FixYes | Affected productcomposer | Published07/08/2026 | SeverityMedium |
CVE-2026-40261Composer has Command Injection via Malicious Perforce Reference | Exploitation statusNot known exploited | FixYes | Affected productcomposer | Published04/15/2026 | SeverityHigh |
CVE-2026-40176Composer is vulnerable to Command Injection via Malicious Perforce Repository | Exploitation statusNot known exploited | FixYes | Affected productcomposer | Published04/15/2026 | SeverityHigh |
CVE-2025-67746Composer vulnerable to ANSI sequence injection | Exploitation statusNot known exploited | FixNot confirmed | Affected productcomposer | Published12/30/2025 | SeverityLow |
CVE-2024-35242Composer vulnerable to command injection via malicious git/hg branch names | Exploitation statusNot known exploited | FixNot confirmed | Affected productcomposer | Published06/10/2024 | SeverityHigh |
CVE-2024-35241Composer vulnerable to command injection via malicious git branch name | Exploitation statusNot known exploited | FixNot confirmed | Affected productcomposer | Published06/10/2024 | SeverityHigh |
CVE-2024-24821Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer | Exploitation statusNot known exploited | FixNot confirmed | Affected productcomposer | Published02/08/2024 | SeverityHigh |
CVE-2023-43655Remote Code Execution via web-accessible composer.phar | Exploitation statusNot known exploited | FixNot confirmed | Affected productcomposer | Published09/29/2023 | SeverityMedium |
CVE-2022-24828Missing input validation can lead to command execution in composer | Exploitation statusNot known exploited | FixNot confirmed | Affected productcomposer | Published04/13/2022 | SeverityHigh |
CVE-2021-41116Command injection in composer on Windows | Exploitation statusNot confirmed | FixYes | Affected productcomposer | Published10/05/2021 | SeverityHigh |
CVE-2021-29472Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer | Exploitation statusNot confirmed | FixNot confirmed | Affected productcomposer | Published04/27/2021 | SeverityHigh |
CVE-2020-15145Local privilege elevation in Composer-Setup for Windows | Exploitation statusNot confirmed | FixNot confirmed | Affected productwindows-setup | Published08/14/2020 | SeverityMedium |
