Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-96h3-5x6v-m776
  • Packagist/composer/composer
 Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path 02 Oct
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-rvx4-ffvw-m9q3
  • Packagist/composer/composer
 Composer arbitrary command execution via a malicious package's Perforce source URL 08 Sep
  • Fix available
  • Severity - 7.7 (High)
GHSA-gjfg-22fp-rrxx
  • Packagist/composer/composer
 Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files 20 Jul
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-g6xq-892h-64w3
  • Packagist/composer/composer
 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) 20 Jul
  • Fix available
  • Severity - 4.7 (Medium)
GHSA-499r-g7pc-vmp9
  • Packagist/composer/composer
 Composer: Arbitrary file write outside vendor via malicious transitive package name 20 Jul
  • Fix available
  • Severity - 7.0 (High)
GHSA-f9f8-rm49-7jv2
  • Packagist/composer/composer
 Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs 19 May
  • Fix available
  • Severity - 7.5 (High)
GHSA-wg36-wvj6-r67p
  • Packagist/composer/composer
 Composer has a command injection via malicious perforce repository 14 Apr
  • Fix available
  • Severity - 7.8 (High)
GHSA-gqw4-4w2p-838q
  • Packagist/composer/composer
 Composer has a command injection via malicious perforce reference 14 Apr
  • Fix available
  • Severity - 8.8 (High)
GHSA-59pp-r3rg-353g
  • Packagist/composer/composer
 Composer is vulnerable to ANSI sequence injection 30 Dec 2025
  • Fix available
  • Severity - 1.2 (Low)
GHSA-47f6-5gq3-vx9c
  • Packagist/composer/composer
 Composer has a command injection via malicious git branch name 10 Jun 2024
  • Fix available
  • Severity - 8.8 (High)
GHSA-v9qv-c7wm-wgmf
  • Packagist/composer/composer
 Composer has multiple command injections via malicious git/hg branch names 10 Jun 2024
  • Fix available
  • Severity - 8.8 (High)
GHSA-7c6p-848j-wh5h
  • Packagist/composer/composer
 Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php 08 Feb 2024
  • Fix available
  • Severity - 8.8 (High)
GHSA-jm6m-4632-36hf
  • Packagist/composer/composer
 Composer Remote Code Execution vulnerability via web-accessible composer.phar 29 Sep 2023
  • Fix available
  • Severity - 8.8 (High)
GHSA-725m-w832-q973
  • Packagist/composer/composer
 Composer allows cache poisoning from other projects built on the same host 21 Sep 2023
  • Fix available
  • Severity - 8.8 (High)
GHSA-x7cr-6qr6-2hh6
  • Packagist/composer/composer
 Missing input validation can lead to command execution in composer 22 Apr 2022
  • Fix available
  • Severity - 8.3 (High)
GHSA-frqg-7g38-6gcf
  • Packagist/composer/composer
 Improper escaping of command arguments on Windows leading to command injection 05 Oct 2021
  • Fix available
  • Severity - 8.2 (High)
Load more...