CVE-2026-45793

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45793
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45793.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45793
Aliases
Downstream
Published
2026-07-15T16:22:19.418Z
Modified
2026-07-17T03:46:45.768814373Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
Details

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using the ghs<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45793.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/composer/composer

Affected ranges

Type
GIT
Repo
https://github.com/composer/composer
Events
Introduced
32df3aa8cdbdaa16df9491b5e672e81c87f94c78
Introduced
378b34c5e33c71d194f33e1b73a62ba22148ff13
Introduced
934ee6eed3c3ffd0aeccef7c1d255adcf0752b24
Fixed
8db20864c72cc97be1d803efe10dc84abf533a05
Fixed
5104b27aaa735dcbadc1bd65f5ff1ef3552c543a
Fixed
39ee8baff8e97a1b657bbfcd6a236ff93a5efbb2
Fixed
3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039
Fixed
65e6390c49f1a11cd8b660d81822086db51fe2d1
Fixed
e66c8fdb7ff5409bd2f358c5f194038e49e93714
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "fixed": "1.10.28"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.2.28"
        },
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.9.8"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0
2.4.0-RC1
2.4.1
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
2.9.0
2.9.0-RC1
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45793.json"