{"schemaVersion":3,"id":"CVE-2025-67746","aliases":["SUSE-SU-2026:0825-1","UBUNTU-CVE-2025-67746","DEBIAN-CVE-2025-67746","openSUSE-SU-2026:10054-1"],"status":"published","duplicateOf":null,"title":null,"description":"Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.","dates":{"published":"2025-12-30T16:11:04.776Z","modified":"2025-12-30T17:30:04.562Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":1.3,"severity":"low","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","exploitability":7.2,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","exploitability":7.2,"impact":2.3,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":1.3,"severity":"low","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00453,"percentile":0.38077,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.006999999999999975,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.0046},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00453,"percentile":0.38077}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00453,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00453,"percentile":0.38077}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","description":"The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/74.html"}],"affected":[{"vendor":"composer","product":"composer","name":"composer","label":"composer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0, < 2.2.26","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.3, < 2.9.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0, < 2.2.26 | ≥ 2.3, < 2.9.3","eol":null,"hubHref":"/vendor/composer/composer"},{"vendor":"debian","product":"composer","name":"composer","label":"composer","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/composer","purlType":"deb","versions":[{"text":"< 2.5.5-1+deb12u3","noFixRecorded":false,"fixedIn":null},{"text":"< 2.8.8-1+deb13u1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.3-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.5-1+deb12u3 | < 2.8.8-1+deb13u1 | < 2.9.3-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"composer","name":"composer","label":"composer","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/composer","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"getcomposer","product":"composer","name":"composer","label":"composer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0.0, < 2.2.26","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.3.0, < 2.9.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.0, < 2.2.26 | ≥ 2.3.0, < 2.9.3","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"composer","label":"Composer","category":"app"}},"hubHref":"/vendor/getcomposer/composer"},{"vendor":"opensuse","product":"php-composer2&distro=openSUSE Leap 15.6","name":"php-composer2","label":"php-composer2&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/php-composer2&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 2.6.4-150600.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.6.4-150600.3.6.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"php-composer2&distro=openSUSE Tumbleweed","name":"php-composer2","label":"php-composer2&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/php-composer2&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 2.9.3-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.3-1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"php-composer2&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP7","name":"php-composer2","label":"php-composer2&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/php-composer2&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP7","purlType":"rpm","versions":[{"text":"< 2.6.4-150600.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.6.4-150600.3.6.1","eol":null,"hubHref":null}],"affectedCount":7,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g","label":"github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Vendor Advisory"]},{"url":"https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917","label":"github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917","hostname":"github.com","tags":["X Refsource MISC","REPORT","Patch"]},{"url":"https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71","label":"github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71","hostname":"github.com","tags":["X Refsource MISC","REPORT","Patch"]},{"url":"https://github.com/composer/composer/releases/tag/2.2.26","label":"github.com/composer/composer/releases/tag/2.2.26","hostname":"github.com","tags":["X Refsource MISC","REPORT","Product","Release Notes"]},{"url":"https://github.com/composer/composer/releases/tag/2.9.3","label":"github.com/composer/composer/releases/tag/2.9.3","hostname":"github.com","tags":["X Refsource MISC","REPORT","Product","Release Notes"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260825-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20260825-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1255768","label":"bugzilla.suse.com/1255768","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67746","label":"www.suse.com/security/cve/CVE-2025-67746","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2025-67746","label":"ubuntu.com/security/CVE-2025-67746","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-67746","label":"www.cve.org/CVERecord?id=CVE-2025-67746","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-67746","label":"security-tracker.debian.org/tracker/CVE-2025-67746","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:21520-1","RHSA-2026:8165","SUSE-SU-2026:23116-1","SUSE-SU-2026:23138-1","SUSE-SU-2026:3105-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:21520-1","SUSE-SU-2026:23116-1","SUSE-SU-2026:23138-1","SUSE-SU-2026:3105-1"]},"timeline":[{"kind":"published","date":"2025-12-30T16:11:04.776Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-12-30T17:30:04.562Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":17,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T18:46:18.352Z","stale":false,"partial":false}}