← Vulnerability feed

Vulnerability record · CVE-2025-67746 · published 30 December 2025

CVE-2025-67746: Getcomposer composer injection vulnerability

Getcomposer · Composer

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

1.3 CVSS 4.0 Low EPSS 0.45% · top 63.1% CWE-74 · Injection
1.3CVSS 4.0 base score
0.45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
17 Jun 2026Last modified by NVD

Description

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917 Patch
https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71 Patch
https://github.com/composer/composer/releases/tag/2.2.26 ProductRelease Notes
https://github.com/composer/composer/releases/tag/2.9.3 ProductRelease Notes
https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g Vendor Advisory

Track CVE-2025-67746 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-41116Getcomposer composer command injection vulnerabilityComposer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependen…EPSS 2.9%8.8CVE-2026-40261Getcomposer composer improper input validation vulnerabilityComposer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce…EPSS 1.9%8.8CVE-2023-43655Getcomposer composer injection vulnerabilityComposer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed …EPSS 1.4%8.8CVE-2015-8371Getcomposer composer insufficient verification of data authenticity vulnerabilityComposer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a ser…EPSS 0.70%8.8CVE-2022-24828Getcomposer composer improper input validation vulnerabilityComposer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a cod…EPSS 1.9%8.8CVE-2021-29472Getcomposer composer argument injection vulnerabilityComposer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitize…EPSS 4.6%7.8CVE-2026-40176Getcomposer composer improper input validation vulnerabilityComposer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce…EPSS 1.00%7.8CVE-2024-24821Getcomposer composer inclusion from untrusted sphere vulnerabilityComposer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the …EPSS 0.28%

Source: NIST National Vulnerability Database (record CVE-2025-67746), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.