composer vulnerabilities

2 known vulnerabilities in composer from Getcomposer. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  composer: Improper Neutralization of Special Elements used in a Command

  CVE-2024-35242Jun 10, 2024ComposerEPSS 3.28%

  Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untr

• 8.8 High severity

  composer: Improper Neutralization of Special Elements used in a Command

  CVE-2024-35241Jun 10, 2024ComposerEPSS 1.05%

  Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used