Skip to content
fr Sign in
8.8 High

CVE-2024-35241 Composer is a dependency manager for PHP

Description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Affected products and versions

Product Affected versions Fixed in
composer 2.3 2.3 → < 2.7.7 2.7.7
composer 2.0 2.0 → < 2.2.24 2.2.24
fedora 40 No fix stated
fedora 39 No fix stated
composer 2.3 2.3 → < 2.7.7 2.7.7

References

Timeline

  1. Published
  2. Last modified

Other CVEs of composer

The 16 CVEs of composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Medium CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 High CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 High CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Medium
Track this CVE