Search for packages
| purl | pkg:composer/composer/composer@1.10.9 |
| Next non-vulnerable version | 1.10.28 |
| Latest non-vulnerable version | 2.10.0-RC1 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7rc9-6ar5-9fak
Aliases: CVE-2021-41116 GHSA-frqg-7g38-6gcf |
arbitrary command execution |
Affected by 4 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-8pap-8xmr-m3ha
Aliases: CVE-2026-40176 GHSA-wg36-wvj6-r67p |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
|
VCID-bnyz-f4w9-27at
Aliases: CVE-2021-29472 GHSA-h5h8-pc6h-jvvx |
arbitrary code execution |
Affected by 5 other vulnerabilities. Affected by 9 other vulnerabilities. |
|
VCID-fzya-vz4m-5yhu
Aliases: CVE-2023-43655 GHSA-jm6m-4632-36hf |
Composer Remote Code Execution vulnerability via web-accessible composer.phar Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has `register_argc_argv` enabled in php.ini. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-kpnb-b563-1yft
Aliases: CVE-2026-40261 GHSA-gqw4-4w2p-838q |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
|
VCID-xjjm-qjy8-aken
Aliases: CVE-2022-24828 GHSA-x7cr-6qr6-2hh6 |
Improper Input Validation Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report. |
Affected by 3 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 7 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||