CVE-2026-59947mediumCWE-532

CVE-2026-59947: falha de média gravidade em composer

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar composer+ Monitorar composer/composer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.7epss 0.1%
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
composer · composer
CVEs relacionadas — composer

No mesmo produto, das mais perigosas para as menos.

CVE-2021-29472HIGHMissing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composerEPSS 4.8%CVE-2024-35242HIGHComposer vulnerable to command injection via malicious git/hg branch namesEPSS 3.3%CVE-2021-41116HIGHCommand injection in composer on WindowsEPSS 2.8%CVE-2022-24828HIGHMissing input validation can lead to command execution in composerEPSS 1.9%CVE-2026-40261HIGHComposer has Command Injection via Malicious Perforce ReferenceEPSS 1.7%CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.5%