| Bug | bookworm | trixie | forky | sid | Description |
|---|
| TEMP-0000000-AA2E99 | vulnerable | vulnerable | fixed | fixed | GHSA-jhfp-4ppm-crmm: Arbitrary command execution via `transport-options.prevent_url_access_callable` loaded from `composer.lock` / `installed.json` |
| TEMP-0000000-41C456 | vulnerable | vulnerable | fixed | fixed | GHSA-x82q-x274-r6pq: Inline repository HTTP credentials sent to attacker controlled dist mirrors supplied in `composer.lock` / `installed.json` |
| TEMP-0000000-6A3A68 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-fm2w-xgf2-f9fh: Inline repository HTTP headers, such as API tokens, are written into composer.lock |
| TEMP-0000000-4A8BFB | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-c968-33g3-wh7p: Package names in vendor/composer/installed.json can escape the vendor directory during install and reinstall |
| TEMP-0000000-0B5912 | vulnerable | vulnerable | fixed | fixed | GHSA-w6hj-6587-3jh5: Arbitrary file write outside the package directory via symlinked zip entries and the `unzip` to `ZipArchive` extraction fallback |
| CVE-2026-84361 | vulnerable | vulnerable (no DSA) | fixed | fixed | Composer is a dependency Manager for the PHP language. From 1.0 until ... |
| CVE-2026-59948 | vulnerable | vulnerable (no DSA) | fixed | fixed | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 ... |
| CVE-2026-59947 | vulnerable | vulnerable (no DSA) | fixed | fixed | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 ... |
| CVE-2026-59946 | vulnerable | vulnerable (no DSA) | fixed | fixed | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 ... |
| CVE-2026-59944 | vulnerable | vulnerable (no DSA) | fixed | fixed | Composer is a dependency Manager for the PHP language. From 1.0 until ... |
| Bug | Description |
|---|
| CVE-2026-45793 | Composer is a dependency Manager for the PHP language. Prior to 1.10.2 ... |
| CVE-2026-40261 | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 ... |
| CVE-2026-40176 | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 ... |
| CVE-2025-67746 | Composer is a dependency manager for PHP. In versions on the 2.x branc ... |
| CVE-2024-35242 | Composer is a dependency manager for PHP. On the 2.x branch prior to v ... |
| CVE-2024-35241 | Composer is a dependency manager for PHP. On the 2.x branch prior to v ... |
| CVE-2024-24821 | Composer is a dependency Manager for the PHP language. In affected ver ... |
| CVE-2023-43655 | Composer is a dependency manager for PHP. Users publishing a composer. ... |
| CVE-2022-24828 | Composer is a dependency manager for the PHP programming language. Int ... |
| CVE-2021-41116 | Composer is an open source dependency manager for the PHP language. In ... |
| CVE-2021-29472 | Composer is a dependency manager for PHP. URLs for Mercurial repositor ... |
| CVE-2015-8371 | Composer before 2016-02-10 allows cache poisoning from other projects ... |