Skip to content
OpenAdvisories
High DSA-5715-1 2 CVEs

composer - security update

Published Jun 18, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 11 composer 2.0.9-2+deb11u3
Debian · 12 composer 2.5.5-1+deb12u2

Vulnerabilities 2

  • High 8.8
    CVE-2024-35241

    Composer vulnerable to command injection via malicious git branch name

    Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist
  • High 8.8
    CVE-2024-35242 Public exploit

    Composer vulnerable to command injection via malicious git/hg branch names

    Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning unt…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist