Skip to content
fr Sign in
8.8 High

CVE-2024-35242 Composer is a dependency manager for PHP

Description

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Affected products and versions

Product Affected versions Fixed in
composer 2.3 2.3 → < 2.7.7 2.7.7
composer 2.0 2.0 → < 2.2.24 2.2.24
fedora 40 No fix stated
fedora 39 No fix stated
composer 2.3 2.3 → < 2.7.7 2.7.7

References

Timeline

  1. Published
  2. Last modified

Other CVEs of composer

The 16 CVEs of composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Medium CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 High CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 High CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Medium
Track this CVE