Composer vulnerable to command injection via malicious git/hg branch names
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 3.3%
exploitation probability
3.3%top 13% of all CVEs
observed exploitation
nono source reports it
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
composer · composerReferences
https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmfhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/