Aller au contenu
en Se connecter
4.7 Moyenne

CVE-2026-59947 Composer is a dependency Manager for the PHP language

Description

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.

Produits et versions touchés

Produit Versions touchées Corrigé en
composer 2.3 2.3.0 → < 2.10.2 2.10.2
composer 1.0 1.0 → < 2.2.29 2.2.29

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de composer

Les 16 CVE de composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Moyenne CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 Élevée CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 Élevée CVE-2026-59948 Composer is a dependency Manager for the PHP language 7.0 Élevée
Suivre cette CVE