Lack of data validation In composer/composer
Description
Composer Remote Code Execution vulnerability via web-accessible composer.phar
Impact
Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has register_argc_argv enabled in php.ini.
Patches
2.6.4, 2.2.22 and 1.10.27 patch this vulnerability.
Workarounds
Make sure register_argc_argv is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | 1.10.27, 2.2.22, 2.6.4 | ||
 debian 12 | 2.5.5-1+deb12u4 | ||
debian 13 | 2.6.4-1 | ||
debian 14 | 2.6.4-1 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8.
References
1. 2. 3. 4. 5. 6. 7.