CVE-2024-35241: composer Command Injection
Vulnerability summary
CVE-2024-35241 is a high (CVSS 8.8) Command Injection vulnerability in composer. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 63.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 10-06-2024PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.05%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.05% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- composer< 2.7.7-r0
Composer1 product
- composer≥ 2.0, < 2.2.24 | ≥ 2.3, < 2.7.7
Debian1 product
- composer< 2.5.5-1+deb12u2 | < 2.7.7-1
Ubuntu1 product
- composer< 1.0.0~beta2-1ubuntu0.1~esm2 | < 1.6.3-1ubuntu0.1~esm2 | < 1.10.1-1ubuntu0.1~esm2 | < 2.2.6-2ubuntu4+esm1 | < 2.7.1-2ubuntu0.1~esm1
Wolfi1 product
- composer< 2.7.7-r0
5 vendors · 5 products
References
13 links- github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9cX Refsource CONFIRMREPORTAdvisory
- github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4X Refsource MISCREPORTFIX
- github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704X Refsource MISCREPORTFIX
