Skip to content
OpenAdvisories
Medium ALAS2023-2026-1800 1 CVE

Moderate: composer security update (Amazon Linux 2023)

Published Jun 8, 2026 · Updated Jun 8, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-45793: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 composer 0:2.9.8-1.amzn2023.0.1

Vulnerabilities 1

  • High 7.5
    CVE-2026-45793

    Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

    Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-45793.html