composer

Records18All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

composer records in CISA KEV

No composer vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Composer 9 records HIGH Composer-setup 1 record LOW

Records

9 records in Composer · all components

TI-2015-06892 CVE-2015-8371 · GHSA-725m-w832-q973

Composer before 2016-02-10 allows cache poisoning from other projects built on the same…

HIGH 73

Composer before 2016-02-10 allows cache poisoning from other projects built on the same host.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00723 Published 2023-09-21 Fixed in 1.0.0 CWE-345

TI-2021-17955 CVE-2021-41116 · GHSA-frqg-7g38-6gcf

Command injection in composer on Windows

MEDIUM 47

Composer is an open source dependency manager for the PHP language.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02825 Published 2021-10-05 Fixed in 1.10.23, 2.1.9 CWE-77

TI-2021-10185 CVE-2021-29472 · GHSA-h5h8-pc6h-jvvx

Code injection in composer

MEDIUM 46

Composer is a dependency manager for PHP.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04752 Published 2021-04-27 Fixed in 1.10.22, 2.0.13 CWE-88

TI-2022-08641 CVE-2022-24828 · GHSA-x7cr-6qr6-2hh6

Missing input validation can lead to command execution in composer

MEDIUM 44

Composer is a dependency manager for the PHP programming language.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01886 Published 2022-04-13 Fixed in 1.10.26, 2.2.12 +2 CWE-20

TI-2026-29055 CVE-2026-40261 · GHSA-gqw4-4w2p-838q

Composer has Command Injection via Malicious Perforce Reference

MEDIUM 43

Composer is a dependency manager for PHP.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01688 Published 2026-04-15 Fixed in 2.9.6, 2.2.27 CWE-20

TI-2023-23380 CVE-2023-43655 · GHSA-jm6m-4632-36hf

Remote Code Execution via web-accessible composer.phar

MEDIUM 43

Composer is a dependency manager for PHP.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01532 Published 2023-09-29 Fixed in 2.2.22, 1.10.27 +1 CWE-74

TI-2024-16338 CVE-2024-24821 · GHSA-7c6p-848j-wh5h

Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer

MEDIUM 40

Composer is a dependency Manager for the PHP language.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00279 Published 2024-02-08 Fixed in 2.2.23, 2.7 +1 CWE-829

TI-2026-28990 CVE-2026-40176 · GHSA-wg36-wvj6-r67p

Composer is vulnerable to Command Injection via Malicious Perforce Repository

LOW 38

Composer is a dependency manager for PHP.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01045 Published 2026-04-15 Fixed in 2.9.6, 2.2.27 CWE-20

TI-2025-41442 CVE-2025-67746 · GHSA-59pp-r3rg-353g

Composer vulnerable to ANSI sequence injection

LOW 8

Composer is a dependency manager for PHP.

CVSS 4.0LOW 1.3 Network Low privileges No interaction EPSS 0.00453 Published 2025-12-30 Fixed in 2.2.26, 2.9.3 CWE-74

Open these records in search →

Critical	1
High	13
Medium	3
Low	1
No CVSS	0