Skip to content
OpenAdvisories

Package · Wolfi

composer

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-40261 Public exploit

    Composer has Command Injection via Malicious Perforce Reference

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escapi…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist
  • High 7.8
    CVE-2026-40176 Public exploit

    Composer is vulnerable to Command Injection via Malicious Perforce Repository

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connecti…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist
  • High 8.8
    CVE-2024-35242 Public exploit

    Composer vulnerable to command injection via malicious git/hg branch names

    Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning unt…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist