7.5

CVE-2026-45793: composer

CVSS: 7.5v3.1HighAwaiting analysis
AliasesUBUNTU-CVE-2026-45793DEBIAN-CVE-2026-45793openSUSE-SU-2026:11300-1
Published 15-07-2026Last modified 15-07-2026
Open JSON

Vulnerability summary

CVE-2026-45793 is a high (CVSS 7.5) vulnerability in composer. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.8% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.02%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 8
OPENSUSE-SU-2026:21520-1OPENSUSE-SU-2026:21970-1SUSE-SU-2026:23116-1SUSE-SU-2026:23138-1SUSE-SU-2026:23943-1SUSE-SU-2026:3105-1

Timeline

  1. 15-07-2026
    PublishedVulnerability first disclosed.
  2. 15-07-2026
    Last modifiedVulnerability information updated.

Description

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

1.02%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

0.00 pp

From 1.02% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.02%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Composer1 product
  • composer≥ 1.0, < 1.10.28 | ≥ 2.0.0, < 2.2.28 | ≥ 2.3.0, < 2.9.8
Debian1 product
  • composer< 2.5.5-1+deb12u5 | < 2.8.8-1+deb13u3 | < 2.10.0-1
Opensuse1 product
  • php-composer2&distro=openSUSE Tumbleweed< 2.10.2-2.1
Ubuntu1 product
  • composerAll versions (No fix recorded)

4 vendors · 4 products

References

13 links
Show all 13 references