composer/composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-59946Mediumcomposer/composer: Composer: Path traversal in package bin field lets dependencies chmod arbitrary host filesCVE-2026-59947Mediumcomposer/composer: Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)CVE-2026-59948Highcomposer/composer: Composer: Arbitrary file write outside vendor via malicious transitive package nameCVE-2026-45793Highcomposer/composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logsCVE-2026-40176Highcomposer/composer: Composer has a command injection via malicious perforce repositoryCVE-2026-40261Highcomposer/composer: Composer has a command injection via malicious perforce referenceCVE-2025-67746Lowcomposer/composer: Composer is vulnerable to ANSI sequence injectionCVE-2024-35241Highcomposer/composer: Composer has a command injection via malicious git branch nameCVE-2024-35242Highcomposer/composer: Composer has multiple command injections via malicious git/hg branch namesCVE-2024-24821Highcomposer/composer: Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.phpCVE-2023-43655Highcomposer/composer: Composer Remote Code Execution vulnerability via web-accessible composer.pharCVE-2015-8371Highcomposer/composer: Composer allows cache poisoning from other projects built on the same hostCVE-2022-24828Highcomposer/composer: Missing input validation can lead to command execution in composerCVE-2021-41116Highcomposer/composer: Improper escaping of command arguments on Windows leading to command injectionCVE-2021-29472Highcomposer/composer: Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo