Read the docs
TI-2024-23311 Aliases CVE-2024-35242GHSA-v9qv-c7wm-wgmf

Composer vulnerable to command injection via malicious git/hg branch names

Priority MEDIUM 46CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03282 88th percentileScored 2026-11-07
Fix Fixed composer (composer): 2.2.24, 2.7.7composer/composer (Packagist): 2.2.24, 2.7.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
composercomposer2.0 to before 2.2.24; 2.3 to before 2.7.72.2.24, 2.7.7Patch availableCNA
—composer/composer (Packagist)2.0 to before 2.2.242.2.24Patch availableGHSA-v9qv-c7wm-wgmf
—composer/composer (Packagist)2.3 to before 2.7.72.7.7Patch availableGHSA-v9qv-c7wm-wgmf
  • composer Vendorcomposer Affected 2.0 to before 2.2.24; 2.3 to before 2.7.7 Fixed in 2.2.24, 2.7.7 Patch available CNA
  • composer/composer (Packagist) Vendor— Affected 2.0 to before 2.2.24 Fixed in 2.2.24 Patch available GHSA-v9qv-c7wm-wgmf
  • composer/composer (Packagist) Vendor— Affected 2.3 to before 2.7.7 Fixed in 2.7.7 Patch available GHSA-v9qv-c7wm-wgmf

CPE names CISA-ADP · 4

CPEVersionsRoleVendor
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39—Fedoraproject
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*40—Fedoraproject
cpe:2.3:a:getcomposer:composer:2.0:*:*:*:*:*:*:*2.0—composer
cpe:2.3:a:getcomposer:composer:2.3:*:*:*:*:*:*:*2.3—composer
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 — ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 — ·Fedoraproject
  • cpe:2.3:a:getcomposer:composer:2.0:*:*:*:*:*:*:* Versions 2.0 — ·composer
  • cpe:2.3:a:getcomposer:composer:2.3:*:*:*:*:*:*:* Versions 2.3 — ·composer

Remediation

  • Fix · CNA composer (composer) Fixed in 2.2.24, 2.7.7
  • Fix · GHSA-v9qv-c7wm-wgmf composer/composer (Packagist) Fixed in 2.2.24 Advisory →
  • Fix · GHSA-v9qv-c7wm-wgmf composer/composer (Packagist) Fixed in 2.7.7 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-35242
  2. 2026-10-03 Alias added: GHSA-v9qv-c7wm-wgmf

References

Advisory 1

Other 8

  • TI-2015-06892 Composer before 2016-02-10 allows cache poisoning from other projects built on the same… CVSS 3.1HIGH 8.8
  • TI-2021-17955 Command injection in composer on Windows CVSS 3.1CRITICAL 9.8
  • TI-2021-10185 Code injection in composer CVSS 3.1HIGH 8.8
  • TI-2022-08641 Missing input validation can lead to command execution in composer CVSS 3.1HIGH 8.8
  • TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
  • TI-2023-23380 Remote Code Execution via web-accessible composer.phar CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences