composer/composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-45793Highcomposer/composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs CVE-2026-40176Highcomposer/composer: Composer has a command injection via malicious perforce repository CVE-2026-40261Highcomposer/composer: Composer has a command injection via malicious perforce reference CVE-2025-67746Lowcomposer/composer: Composer is vulnerable to ANSI sequence injection CVE-2024-35241Highcomposer/composer: Composer has a command injection via malicious git branch name CVE-2024-35242Highcomposer/composer: Composer has multiple command injections via malicious git/hg branch names CVE-2024-24821Highcomposer/composer: Composer code execution and possible privilege escalation via compromised InstalledVersions.php or…CVE-2023-43655Highcomposer/composer: Composer Remote Code Execution vulnerability via web-accessible composer.phar CVE-2015-8371Highcomposer/composer: Composer allows cache poisoning from other projects built on the same host CVE-2022-24828Highcomposer/composer: Missing input validation can lead to command execution in composer CVE-2021-41116Highcomposer/composer: Improper escaping of command arguments on Windows leading to command injection CVE-2021-29472Highcomposer/composer: Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo