Search for packages
| purl | pkg:composer/composer/composer@1.10.26 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-8pap-8xmr-m3ha
Aliases: CVE-2026-40176 GHSA-wg36-wvj6-r67p |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
|
VCID-fzya-vz4m-5yhu
Aliases: CVE-2023-43655 GHSA-jm6m-4632-36hf |
Composer Remote Code Execution vulnerability via web-accessible composer.phar Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has `register_argc_argv` enabled in php.ini. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-kpnb-b563-1yft
Aliases: CVE-2026-40261 GHSA-gqw4-4w2p-838q |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-xjjm-qjy8-aken | Improper Input Validation Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report. |
CVE-2022-24828
GHSA-x7cr-6qr6-2hh6 |