~ / search / GHSA-v9qv-c7wm-wgmf

GHSA-v9qv-c7wm-wgmf

Composer has multiple command injections via malicious git/hg branch names

Source: GitHub Advisory Database (reviewed) High CVE-2024-35242

Packages

EcosystemPackageAffectedFixed in
Packagist composer/composer >= 2.0, < 2.2.24 2.2.24
Packagist composer/composer >= 2.3, < 2.7.7 2.7.7

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories. ### Patches 2.2.24 for 2.2 LTS or 2.7.7 for mainline ### Workarounds Avoid cloning potentially compromised repositories.

References

External links from the advisory. They lead to third-party sites.