Vulnerabilidades em composer
15 resultadosAnálise Vexday
O Composer apresenta 15 vulnerabilidades catalogadas, com 4 divulgadas nos últimos 90 dias, indicando risco recente e contínuo. Nenhuma está sob exploração ativa conhecida (KEV) ou classificada como crítica, mas a fraqueza dominante em validação inadequada de entrada (CWE-20) requer atenção em processos de integração de dependências.
CVE-2021-29472HIGHMissing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composerEPSS 4.7%CVE-2024-35242HIGHComposer vulnerable to command injection via malicious git/hg branch namesEPSS 3.3%CVE-2021-41116HIGHCommand injection in composer on WindowsEPSS 2.9%CVE-2022-24828HIGHMissing input validation can lead to command execution in composerEPSS 1.9%CVE-2026-40261HIGHComposer has Command Injection via Malicious Perforce ReferenceEPSS 1.7%CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.4%CVE-2026-40176HIGHComposer is vulnerable to Command Injection via Malicious Perforce RepositoryEPSS 1.1%CVE-2024-35241HIGHComposer vulnerable to command injection via malicious git branch nameEPSS 1.1%CVE-2026-45793HIGHComposer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logsEPSS 0.8%CVE-2025-67746LOWComposer vulnerable to ANSI sequence injectionEPSS 0.4%CVE-2020-15145MEDIUMLocal privilege elevation in Composer-Setup for WindowsEPSS 0.4%CVE-2024-24821HIGHCode execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in ComposerEPSS 0.3%CVE-2026-59946MEDIUMComposer: Path traversal in package bin field lets dependencies chmod arbitrary host filesEPSS 0.1%CVE-2026-59948HIGHComposer: Arbitrary file write outside vendor via malicious transitive package nameEPSS 0.1%CVE-2026-59947MEDIUMComposer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)EPSS 0.1%