Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hnah-ry8y-77d6
Vulnerability ID VCID-hnah-ry8y-77d6
Aliases CVE-2024-35241
GHSA-47f6-5gq3-vx9c
Summary Composer has a command injection via malicious git branch name The `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00442 https://api.first.org/data/v1/epss?cve=CVE-2024-35241
cvssv3.1 7.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-47f6-5gq3-vx9c
cvssv3.1 8.8 https://github.com/composer/composer
generic_textual HIGH https://github.com/composer/composer
cvssv3.1 8.8 https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4
generic_textual HIGH https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4
ssvc Track https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4
cvssv3.1 8.8 https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704
generic_textual HIGH https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704
ssvc Track https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704
cvssv3.1 8.8 https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
cvssv3.1_qr HIGH https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
generic_textual HIGH https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
ssvc Track https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
cvssv3.1 8.8 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC
cvssv3.1 8.8 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
cvssv3.1 8.8 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC
cvssv3.1 8.8 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2024-35241
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-35241
cvssv3.1 8.8 https://www.vicarius.io/vsociety/posts/cve-2024-35241-detect-composer-vulnerability
generic_textual HIGH https://www.vicarius.io/vsociety/posts/cve-2024-35241-detect-composer-vulnerability
cvssv3.1 8.8 https://www.vicarius.io/vsociety/posts/cve-2024-35241-mitigate-vulnerable-composer
generic_textual HIGH https://www.vicarius.io/vsociety/posts/cve-2024-35241-mitigate-vulnerable-composer
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-35241
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35241
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35242
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/composer/composer
https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4
https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC
1073125 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073125
CVE-2024-35241 https://nvd.nist.gov/vuln/detail/CVE-2024-35241
CVE-2024-35241-DETECT-COMPOSER-VULNERABILITY https://www.vicarius.io/vsociety/posts/cve-2024-35241-detect-composer-vulnerability
CVE-2024-35241-MITIGATE-VULNERABLE-COMPOSER https://www.vicarius.io/vsociety/posts/cve-2024-35241-mitigate-vulnerable-composer
GHSA-47f6-5gq3-vx9c https://github.com/advisories/GHSA-47f6-5gq3-vx9c
GHSA-47f6-5gq3-vx9c https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
USN-7603-1 https://usn.ubuntu.com/7603-1/
VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/composer/composer
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-15T20:42:58Z/ Found at https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-15T20:42:58Z/ Found at https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-15T20:42:58Z/ Found at https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-15T20:42:58Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-15T20:42:58Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-35241
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.vicarius.io/vsociety/posts/cve-2024-35241-detect-composer-vulnerability
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.vicarius.io/vsociety/posts/cve-2024-35241-mitigate-vulnerable-composer
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.63649
EPSS Score 0.00442
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:21:56.332338+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2024-35241.yml 38.6.0