Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| composer | composer | 1.0 to before 2.2.29; 2.3.0 to before 2.10.2 | 2.2.29, 2.10.2 | Patch available | CNA |
| — | composer/composer (Packagist) | 2.3.0 to before 2.10.2 | 2.10.2 | Patch available | GHSA-g6xq-892h-64w3 |
| — | composer/composer (Packagist) | 1.0.0 to before 2.2.29 | 2.2.29 | Patch available | GHSA-g6xq-892h-64w3 |
- composer Vendorcomposer Affected 1.0 to before 2.2.29; 2.3.0 to before 2.10.2 Fixed in 2.2.29, 2.10.2 Patch available CNA
- composer/composer (Packagist) Vendor— Affected 2.3.0 to before 2.10.2 Fixed in 2.10.2 Patch available GHSA-g6xq-892h-64w3
- composer/composer (Packagist) Vendor— Affected 1.0.0 to before 2.2.29 Fixed in 2.2.29 Patch available GHSA-g6xq-892h-64w3
Remediation
- Fix · CNA composer (composer) Fixed in 2.2.29, 2.10.2
- Fix · GHSA-g6xq-892h-64w3 composer/composer (Packagist) Fixed in 2.10.2 Advisory →
- Fix · GHSA-g6xq-892h-64w3 composer/composer (Packagist) Fixed in 2.2.29 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59947
- 2026-10-03 Alias added: GHSA-g6xq-892h-64w3
References
Other 6
- https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3
- https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8
- https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec
- https://github.com/composer/composer/releases/tag/2.10.2
- https://github.com/composer/composer/releases/tag/2.2.29
- https://github.com/composer/composer
More composer vulnerabilities
- TI-2015-06892 Composer before 2016-02-10 allows cache poisoning from other projects built on the same… CVSS 3.1HIGH 8.8
- TI-2021-17955 Command injection in composer on Windows CVSS 3.1CRITICAL 9.8
- TI-2024-23311 Composer vulnerable to command injection via malicious git/hg branch names CVSS 3.1HIGH 8.8
- TI-2021-10185 Code injection in composer CVSS 3.1HIGH 8.8
- TI-2022-08641 Missing input validation can lead to command execution in composer CVSS 3.1HIGH 8.8
- TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
Sources
- CVE-2026-59947 · CVE Program
- CVE-2026-59947 · NVD
- FIRST EPSS
- GHSA-g6xq-892h-64w3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-59947 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences