Read the docs
TI-2024-23310 Aliases CVE-2024-35241GHSA-47f6-5gq3-vx9c

Composer vulnerable to command injection via malicious git branch name

Priority MEDIUM 42CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0105 64th percentileScored 2026-11-07
Fix Fixed composer (composer): 2.2.24, 2.7.7composer/composer (Packagist): 2.2.24, 2.7.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
composercomposer2.0 to before 2.2.24; 2.3 to before 2.7.72.2.24, 2.7.7Patch availableCNA
—composer/composer (Packagist)2.0 to before 2.2.242.2.24Patch availableGHSA-47f6-5gq3-vx9c
—composer/composer (Packagist)2.3 to before 2.7.72.7.7Patch availableGHSA-47f6-5gq3-vx9c
  • composer Vendorcomposer Affected 2.0 to before 2.2.24; 2.3 to before 2.7.7 Fixed in 2.2.24, 2.7.7 Patch available CNA
  • composer/composer (Packagist) Vendor— Affected 2.0 to before 2.2.24 Fixed in 2.2.24 Patch available GHSA-47f6-5gq3-vx9c
  • composer/composer (Packagist) Vendor— Affected 2.3 to before 2.7.7 Fixed in 2.7.7 Patch available GHSA-47f6-5gq3-vx9c

CPE names CISA-ADP · 4

CPEVersionsRoleVendor
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39—Fedoraproject
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*40—Fedoraproject
cpe:2.3:a:getcomposer:composer:2.0:*:*:*:*:*:*:*2.0—composer
cpe:2.3:a:getcomposer:composer:2.3:*:*:*:*:*:*:*2.3—composer
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 — ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 — ·Fedoraproject
  • cpe:2.3:a:getcomposer:composer:2.0:*:*:*:*:*:*:* Versions 2.0 — ·composer
  • cpe:2.3:a:getcomposer:composer:2.3:*:*:*:*:*:*:* Versions 2.3 — ·composer

Remediation

  • Fix · CNA composer (composer) Fixed in 2.2.24, 2.7.7
  • Fix · GHSA-47f6-5gq3-vx9c composer/composer (Packagist) Fixed in 2.2.24 Advisory →
  • Fix · GHSA-47f6-5gq3-vx9c composer/composer (Packagist) Fixed in 2.7.7 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-35241
  2. 2026-10-03 Alias added: GHSA-47f6-5gq3-vx9c

References

Advisory 1

Other 10

  • TI-2015-06892 Composer before 2016-02-10 allows cache poisoning from other projects built on the same… CVSS 3.1HIGH 8.8
  • TI-2021-17955 Command injection in composer on Windows CVSS 3.1CRITICAL 9.8
  • TI-2024-23311 Composer vulnerable to command injection via malicious git/hg branch names CVSS 3.1HIGH 8.8
  • TI-2021-10185 Code injection in composer CVSS 3.1HIGH 8.8
  • TI-2022-08641 Missing input validation can lead to command execution in composer CVSS 3.1HIGH 8.8
  • TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences