GitHub Advisoryadvisory · Packagist

GHSA-v9qv-c7wm-wgmf Composer has multiple command injections via malicious git/hg branch names

HIGH Published 2024-06-10 Modified 2025-02-13 Official page ↗
Aliases
CVE-2024-35242
Ecosystem
Packagist
Packages
composer/composer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2024-06-10

Affected packages

• Packagist composer/composer: >= 2.0, < 2.2.24 → fixed in 2.2.24 • Packagist composer/composer: >= 2.3, < 2.7.7 → fixed in 2.7.7

Description

Impact The `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories. Patches 2.2.24 for 2.2 LTS or 2.7.7 for mainline Workarounds Avoid cloning potentially compromised repositories.

Related

Alias · CVE (1)

  • CVE-2024-35242 Composer is a dependency manager for PHP. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References