Skip to content
OpenAdvisories
High · 7.5 CVE-2026-45793 BIT-composer-2026-45793EUVD-2026-44723GHSA-f9f8-rm49-7jv2

Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

Published Jul 15, 2026 · Updated Jul 15, 2026 · Assigned by GitHub_M

Vendor: composer Product: composer Package: composer Package: composer Package: composer Package: composer/composer Ecosystem: Alpine Ecosystem: Debian Ecosystem: Packagist Ecosystem: Ubuntu

Description

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

Affected products

VendorProductAffectedFixed
composer composer >= 1.0, < 1.10.28, >= 2.0.0, < 2.2.28, >= 2.3.0, < 2.9.8 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 composer 2.10.0-1 —
Debian 13 composer 2.8.8-1+deb13u3 —
Debian 12 composer 2.5.5-1+deb12u5 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS composer No fix yet —
Ubuntu Pro 18.04 LTS composer No fix yet —
Ubuntu Pro 16.04 LTS composer No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 php-composer2 2.6.4-150600.3.12.1 SUSE-SU-2026:4288-1, SUSE-SU-2026:3105-1
SLES 15 SP6 php-composer2 2.6.4-150600.3.12.1 SUSE-SU-2026:3105-1
SLES 15 SP5 php-composer2 2.2.30-150400.3.21.1 SUSE-SU-2026:4283-1
SLES 15 SP4 php-composer2 2.2.30-150400.3.21.1 SUSE-SU-2026:4283-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 php-composer2 2.8.9-160000.4.1 SUSE-SU-2026:23943-1, SUSE-SU-2026:23138-1, SUSE-SU-2026:23116-1
SLES for SAP 15 SP6 php-composer2 2.6.4-150600.3.12.1 SUSE-SU-2026:3105-1
SLES for SAP 15 SP5 php-composer2 2.2.30-150400.3.21.1 SUSE-SU-2026:4283-1
SLES for SAP 15 SP4 php-composer2 2.2.30-150400.3.21.1 SUSE-SU-2026:4283-1
SLES 16.0 php-composer2 2.8.9-160000.4.1 SUSE-SU-2026:23943-1, SUSE-SU-2026:23138-1, SUSE-SU-2026:23116-1
SLE HPC 15 SP5 php-composer2 2.2.30-150400.3.21.1 SUSE-SU-2026:4283-1
SLE HPC 15 SP4 php-composer2 2.2.30-150400.3.21.1 SUSE-SU-2026:4283-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed php-composer2 2.10.2-2.1 openSUSE-SU-2026:11300-1
openSUSE Leap 16.0 php-composer2 2.8.9-160000.4.1 openSUSE-SU-2026:21970-1, openSUSE-SU-2026:21520-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 composer 2.9.8-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 composer 2.9.8-1.amzn2023.0.1 ALAS2023-2026-1800

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist composer/composer >= 2.3.0, < 2.9.8 2.9.8 GHSA-f9f8-rm49-7jv2
Packagist composer/composer >= 2.0.0, < 2.2.28 2.2.28 GHSA-f9f8-rm49-7jv2
Packagist composer/composer >= 1.0, < 1.10.28 1.10.28 GHSA-f9f8-rm49-7jv2

Advisories 10

References