Skip to content
OpenAdvisories
High DLA-3838-1 2 CVEs

composer - security update

Published Jun 19, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 composer 1.8.4-1+deb10u4

Vulnerabilities 2

  • High 8.8
    CVE-2024-35241

    Composer vulnerable to command injection via malicious git branch name

    Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist
  • High 8.8
    CVE-2024-35242 Public exploit

    Composer vulnerable to command injection via malicious git/hg branch names

    Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning unt…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist