CVE-2024-35242: composer Command Injection
Vulnerability summary
CVE-2024-35242 is a high (CVSS 8.8) Command Injection vulnerability in composer. EPSS estimates a 3.28% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 10-06-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.28%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- composer< 2.7.7-r0
Composer1 product
- composer≥ 2.0, < 2.2.24 | ≥ 2.3, < 2.7.7
Debian1 product
- composer< 2.5.5-1+deb12u2 | < 2.7.7-1
Ubuntu1 product
- composer< 1.0.0~beta2-1ubuntu0.1~esm2 | < 1.6.3-1ubuntu0.1~esm2 | < 1.10.1-1ubuntu0.1~esm2 | < 2.2.6-2ubuntu4+esm1 | < 2.7.1-2ubuntu0.1~esm1
Wolfi1 product
- composer< 2.7.7-r0
5 vendors · 5 products
References
11 links- github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmfX Refsource CONFIRMREPORTAdvisory
- github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396X Refsource MISCREPORTFIX
- github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467X Refsource MISCREPORTFIX
