CVE-2025-67746lowCWE-74

CVE-2025-67746: fallo de gravedad baja en composer

Composer vulnerable to ANSI sequence injection

Publicada el

Seguir esta CVE+ Monitorear composer+ Monitorear composer/composer

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 1.3epss 0.5%
Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Productos afectados
composer · composer
CVEs relacionadas — composer

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-29472HIGHMissing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composerEPSS 4.8%CVE-2024-35242HIGHComposer vulnerable to command injection via malicious git/hg branch namesEPSS 3.3%CVE-2021-41116HIGHCommand injection in composer on WindowsEPSS 2.8%CVE-2022-24828HIGHMissing input validation can lead to command execution in composerEPSS 1.9%CVE-2026-40261HIGHComposer has Command Injection via Malicious Perforce ReferenceEPSS 1.7%CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.5%