Composer vulnerabilities
We track 10 vulnerabilities in Composer products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on September 1, 2026.
Latest Composer vulnerabilities
- 7.7 High severity
composer: Improper Neutralization of Special Elements used in an OS Command
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4P
- 7.5 High severity
composer: Exposure of Sensitive Information to an Unauthorized Actor
Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException;
- 7.0 High severity
composer: Improper Limitation of a Pathname to a Restricted Directory
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor
- 8.8 High severity
composer: Improper Neutralization of Special Elements used in an OS Command
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escapin
- 7.8 High severity
composer: Improper Neutralization of Special Elements used in an OS Command
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connectio
- 8.8 High severity
composer: Improper Neutralization of Special Elements used in a Command
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untr
- 8.8 High severity
composer: Improper Neutralization of Special Elements used in a Command
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used
- 7.8 High severity
composer: Inclusion of Functionality from Untrusted Control Sphere
Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary co
- 8.8 High severity
composer: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enab
- 8.8 High severity
composer: Improper Neutralization of Argument Delimiters in a Command
Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulner