https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:43:59 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-04880 bdu:2024-04880 https://cve.radiocsirt.org/vuln/bdu:2024-04880 https://cve.radiocsirt.org/vuln/bit-composer-2024-35242 <p><strong>Affected:</strong> Bitnami: composer</p> <p>Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.</p> <p><strong>Affected:</strong> Bitnami: composer</p> <p>Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.</p> https://cve.radiocsirt.org/vuln/bit-composer-2024-35242 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0836 certfr-2025-avi-0836 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0836 https://cve.radiocsirt.org/vuln/cleanstart-2024-dd29597 <p><strong>Affected:</strong> CleanStart: composer</p> <p>Security vulnerability affects the composer package. Composer is a dependency manager for PHP.</p> <p><strong>Affected:</strong> CleanStart: composer</p> <p>Security vulnerability affects the composer package. Composer is a dependency manager for PHP.</p> https://cve.radiocsirt.org/vuln/cleanstart-2024-dd29597 https://cve.radiocsirt.org/vuln/euvd-2026-217420 EUVD-2026-217420 https://cve.radiocsirt.org/vuln/euvd-2026-217420 https://cve.radiocsirt.org/vuln/fkie_cve-2024-35242 <p>Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.</p> <p>Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-35242 https://cve.radiocsirt.org/vuln/ghsa-v9qv-c7wm-wgmf <p><strong>Affected:</strong> Packagist: composer/composer</p> <p>### Impact</p> <p>The `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories.</p> <p>### Patches</p> <p>2.2.24 for 2.2 LTS or 2.7.7 for mainline</p> <p>### Workarounds</p> <p>Avoid cloning potentially compromised repositories.</p> <p><strong>Affected:</strong> Packagist: composer/composer</p> <p>### Impact</p> <p>The `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories.</p> <p>### Patches</p> <p>2.2.24 for 2.2 LTS or 2.7.7 for mainline</p> <p>### Workarounds</p> <p>Avoid cloning potentially compromised repositories.</p> https://cve.radiocsirt.org/vuln/ghsa-v9qv-c7wm-wgmf https://cve.radiocsirt.org/vuln/opensuse-su-2024:14040-1 <p>php-composer2-2.7.7-1.1 on GA media</p> <p>php-composer2-2.7.7-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14040-1 https://cve.radiocsirt.org/vuln/suse-su-2024:2107-1 <p>Security update for php-composer2</p> <p>Security update for php-composer2</p> https://cve.radiocsirt.org/vuln/suse-su-2024:2107-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-35242 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: composer, Ubuntu:Pro:18.04:LTS: composer, Ubuntu:Pro:20.04:LTS: composer, Ubuntu:Pro:22.04:LTS: composer, Ubuntu:Pro:24.04:LTS: composer</p> <p>Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: composer, Ubuntu:Pro:18.04:LTS: composer, Ubuntu:Pro:20.04:LTS: composer, Ubuntu:Pro:22.04:LTS: composer, Ubuntu:Pro:24.04:LTS: composer</p> <p>Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-35242