Composer vulnerable to command injection via malicious git branch name (composer composer)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.05 % · percentile 64 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Deferred
Description
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.
Weaknesses (CWE)
- CWE-77 — Improper Neutralization of Special Elements used in a Command
References
- https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
- https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4
- https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
- https://www.vicarius.io/vsociety/posts/cve-2024-35241-detect-composer-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2024-35241-mitigate-vulnerable-composer
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | GitHub_M |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-47f6-5gq3-vx9c — Composer has a command injection via malicious git branch name
European references
- ENISA EUVD · EUVD-2024-1909
- GCVE · GCVE-0-2024-35241
CERT-FR advisories
- CERTFR-2025-AVI-0836 — Multiples vulnérabilités dans les produits Tenable · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| composer · composer | affected >= 2.0, < 2.2.24 ; affected >= 2.3, < 2.7.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |