Skip to content
Sign in
4.7 Medium

CVE-2026-59947 Composer is a dependency Manager for the PHP language

Description

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.

Affected products and versions

Product Affected versions Fixed in
composer 2.3 2.3.0 → < 2.10.2 2.10.2
composer 1.0 1.0 → < 2.2.29 2.2.29

Other CVEs of composer

The 16 CVEs of composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Medium CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 High CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 High CVE-2026-59948 Composer is a dependency Manager for the PHP language 7.0 High
Track this CVE