Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-45793 Composer is a dependency Manager for the PHP language

Description

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

Produits et versions touchés

Produit Versions touchées Corrigé en
composer 2.3 2.3.0 → < 2.9.8 2.9.8
composer 2.0 2.0.0 → < 2.2.28 2.2.28
composer 1.0 1.0 → < 1.10.28 1.10.28

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de composer

Les 16 CVE de composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Moyenne CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 Élevée CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Moyenne CVE-2026-59948 Composer is a dependency Manager for the PHP language 7.0 Élevée
Suivre cette CVE