GitHub Advisoryadvisory · Packagist

GHSA-47f6-5gq3-vx9c Composer has a command injection via malicious git branch name

HIGH Published 2024-06-10 Modified 2025-04-23 Official page ↗
Aliases
CVE-2024-35241
Ecosystem
Packagist
Packages
composer/composer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2024-06-10

Affected packages

• Packagist composer/composer: >= 2.0, < 2.2.24 → fixed in 2.2.24 • Packagist composer/composer: >= 2.3, < 2.7.7 → fixed in 2.7.7

Description

Impact The `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches 2.2.24 for 2.2 LTS or 2.7.7 for mainline Workarounds Avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Related

Alias · CVE (1)

  • CVE-2024-35241 Composer is a dependency manager for PHP. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References