CVE-2026-59947

EUVD-2026-42363

08.07.2026, 20:16

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.7 MEDIUM	LOCAL	HIGH	LOW	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 2.16%

Debian Releases

Debian Product

Codename

composer

bookworm	vulnerable
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	2.10.2-1 fixed
sid	2.10.2-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

composer

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage

Amazon Linux Releases

Amazon Package

Release

composer

Amazon Linux 2023

0:2.10.2-1.amzn2023.0.1

fixed

Common Weakness Enumeration

CWE-532 - Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References

https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8

https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec

https://github.com/composer/composer/releases/tag/2.10.2

https://github.com/composer/composer/releases/tag/2.2.29

https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3