VulnerableCode Package Details - pkg:composer/composer/composer@2.0.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-52e4-4t6n-p3e9 Aliases: CVE-2025-67746 GHSA-59pp-r3rg-353g	Composer is vulnerable to ANSI sequence injection Attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but Composer still published a CVE as it has potential for abuse, and Composer wants to be on the safe side informing users that they should upgrade.	2.2.26 Affected by 0 other vulnerabilities. 2.9.3 Affected by 0 other vulnerabilities.
VCID-5ccv-kq34-9kf2 Aliases: CVE-2021-41116 GHSA-frqg-7g38-6gcf	arbitrary command execution	2.1.9 Affected by 0 other vulnerabilities.
VCID-8zzn-tauw-mydc Aliases: CVE-2022-24828 GHSA-x7cr-6qr6-2hh6	Improper Input Validation Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.	2.2.12 Affected by 0 other vulnerabilities. 2.3.5 Affected by 0 other vulnerabilities.
VCID-bfsn-ds7s-j3ha Aliases: CVE-2023-43655 GHSA-jm6m-4632-36hf	Composer Remote Code Execution vulnerability via web-accessible composer.phar Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has `register_argc_argv` enabled in php.ini.	2.2.22 Affected by 0 other vulnerabilities. 2.6.4 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-52e4-4t6n-p3e9
Aliases:
CVE-2025-67746
GHSA-59pp-r3rg-353g

Composer is vulnerable to ANSI sequence injection Attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but Composer still published a CVE as it has potential for abuse, and Composer wants to be on the safe side informing users that they should upgrade.

2.2.26
Affected by 0 other vulnerabilities.

2.9.3
Affected by 0 other vulnerabilities.

VCID-5ccv-kq34-9kf2
Aliases:
CVE-2021-41116
GHSA-frqg-7g38-6gcf

arbitrary command execution

2.1.9
Affected by 0 other vulnerabilities.

VCID-8zzn-tauw-mydc
Aliases:
CVE-2022-24828
GHSA-x7cr-6qr6-2hh6

Improper Input Validation Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

2.2.12
Affected by 0 other vulnerabilities.

2.3.5
Affected by 0 other vulnerabilities.

VCID-bfsn-ds7s-j3ha
Aliases:
CVE-2023-43655
GHSA-jm6m-4632-36hf

Composer Remote Code Execution vulnerability via web-accessible composer.phar Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has `register_argc_argv` enabled in php.ini.

2.2.22
Affected by 0 other vulnerabilities.

2.6.4
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-02T04:49:19.443132+00:00	GitLab Importer	Affected by	VCID-52e4-4t6n-p3e9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2025-67746.yml	38.6.0
2026-06-02T04:45:54.536020+00:00	GitLab Importer	Affected by	VCID-bfsn-ds7s-j3ha	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2023-43655.yml	38.6.0
2026-06-02T04:42:07.017228+00:00	GitLab Importer	Affected by	VCID-8zzn-tauw-mydc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2022-24828.yml	38.6.0
2026-06-02T04:40:07.390888+00:00	GitLab Importer	Affected by	VCID-5ccv-kq34-9kf2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2021-41116.yml	38.6.0