GitHub Advisoryadvisory · Packagist
GHSA-59pp-r3rg-353g Composer is vulnerable to ANSI sequence injection
LOW
Official page ↗
- Aliases
- CVE-2025-67746
- Ecosystem
- Packagist
- Packages
- composer/composer
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-74
- Reviewed
- 2025-12-30
Affected packages
• Packagist composer/composer: >= 2.0.0, < 2.2.26 → fixed in 2.2.26
• Packagist composer/composer: >= 2.3.0, < 2.9.3 → fixed in 2.9.3
Description
Impact
Attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application.
There is no proven exploit and this has thus a low severity but Composer still published a CVE as it has potential for abuse, and Composer wants to be on the safe side informing users that they should upgrade.
Patches
2.2.26 for 2.2 LTS or 2.9.3 for mainline.
Related
Alias · CVE (1)
- CVE-2025-67746 Composer is a dependency manager for PHP. vulnerability
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g web
- https://nvd.nist.gov/vuln/detail/CVE-2025-67746 advisory
- https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917 web
- https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71 web
- https://github.com/composer/composer package
- https://github.com/composer/composer/releases/tag/2.2.26 web
- https://github.com/composer/composer/releases/tag/2.9.3 web