Missing input validation can lead to command execution in composer
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-88.
Summary
Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| composer | composer | before 1.10.26; 2.0.0 to before 2.2.12; 2.3 to before 2.3.6 | 1.10.26, 2.2.12, 2.3.6 | Patch available | CNA |
| — | composer/composer (Packagist) | before 1.10.26 | 1.10.26 | Patch available | GHSA-x7cr-6qr6-2hh6 |
| — | composer/composer (Packagist) | 2.0 to before 2.2.12 | 2.2.12 | Patch available | GHSA-x7cr-6qr6-2hh6 |
| — | composer/composer (Packagist) | 2.3 to before 2.3.5 | 2.3.5 | Patch available | GHSA-x7cr-6qr6-2hh6 |
- composer Vendorcomposer Affected before 1.10.26; 2.0.0 to before 2.2.12; 2.3 to before 2.3.6 Fixed in 1.10.26, 2.2.12, 2.3.6 Patch available CNA
- composer/composer (Packagist) Vendor— Affected before 1.10.26 Fixed in 1.10.26 Patch available GHSA-x7cr-6qr6-2hh6
- composer/composer (Packagist) Vendor— Affected 2.0 to before 2.2.12 Fixed in 2.2.12 Patch available GHSA-x7cr-6qr6-2hh6
- composer/composer (Packagist) Vendor— Affected 2.3 to before 2.3.5 Fixed in 2.3.5 Patch available GHSA-x7cr-6qr6-2hh6
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:* | before 1.10.26; 2.0.0 to before 2.2.12; 2.3.0 to before 2.3.5 | Vulnerable | composer |
| cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* | before 5.21.0 | Vulnerable | Tenable |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
- cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:* Versions before 1.10.26; 2.0.0 to before 2.2.12; 2.3.0 to before 2.3.5 Vulnerable ·composer
- cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* Versions before 5.21.0 Vulnerable ·Tenable
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA composer (composer) Fixed in 1.10.26, 2.2.12, 2.3.6
- Fix · GHSA-x7cr-6qr6-2hh6 composer/composer (Packagist) Fixed in 1.10.26 Advisory →
- Fix · GHSA-x7cr-6qr6-2hh6 composer/composer (Packagist) Fixed in 2.2.12 Advisory →
- Fix · GHSA-x7cr-6qr6-2hh6 composer/composer (Packagist) Fixed in 2.3.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-24828
- 2026-10-03 Alias added: GHSA-x7cr-6qr6-2hh6
References
Patch 2
Advisory 5
Other 5
- https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2022-24828.yaml
- https://github.com/composer/composer
- https://lists.fedoraproject.org/archives/list/[email protected]/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GWT6LDSRY7SFMTDZWJ4MS2ZBXHL7VQEF
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QD7JQWL6C4GVROO25DTXWYWM6BPOPPCG
More Composer vulnerabilities
- TI-2015-06892 Composer before 2016-02-10 allows cache poisoning from other projects built on the same… CVSS 3.1HIGH 8.8
- TI-2021-17955 Command injection in composer on Windows CVSS 3.1CRITICAL 9.8
- TI-2021-10185 Code injection in composer CVSS 3.1HIGH 8.8
- TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
- TI-2023-23380 Remote Code Execution via web-accessible composer.phar CVSS 3.1HIGH 8.8
- TI-2024-16338 Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer CVSS 3.1HIGH 8.8
Sources
- CVE-2022-24828 · CVE Program
- CVE-2022-24828 · NVD
- FIRST EPSS
- GHSA-x7cr-6qr6-2hh6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences