[HIGH] Command injection via malicious Perforce repository definition

PKSA-6bp1-9hfj-2cgv CVE-2026-40176 GHSA-wg36-wvj6-r67p

Affected version: >=2.3,<2.9.6|>=1.0,<2.2.27

Reported by:
FriendsOfPHP/security-advisories, GitHub

[HIGH] Command injection via malicious Perforce source reference/url

PKSA-t5r2-p5q9-mtpn CVE-2026-40261 GHSA-gqw4-4w2p-838q

Affected version: >=2.3,<2.9.6|>=1.0,<2.2.27

Reported by:
FriendsOfPHP/security-advisories, GitHub

[LOW] Composer is vulnerable to ANSI sequence injection

PKSA-1gck-s111-yq7g CVE-2025-67746 GHSA-59pp-r3rg-353g

Affected version: >=2.3.0,<2.9.3|>=2.0.0,<2.2.26

Reported by:
GitHub

[HIGH] Composer has a command injection via malicious git branch name

PKSA-s25b-vbmp-jvhh CVE-2024-35241 GHSA-47f6-5gq3-vx9c

Affected version: >=2.3,<2.7.7|>=2.0,<2.2.24

Reported by:
GitHub

[HIGH] Composer has multiple command injections via malicious git/hg branch names

PKSA-b8f7-zn44-r4gz CVE-2024-35242 GHSA-v9qv-c7wm-wgmf

Affected version: >=2.3,<2.7.7|>=2.0,<2.2.24

Reported by:
GitHub

[HIGH] Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php

PKSA-jn72-4kr8-gj3h CVE-2024-24821 GHSA-7c6p-848j-wh5h

Affected version: >=2.3.0-rc1,<2.7.0|>=2.0.0-alpha1,<2.2.23

Reported by:
GitHub

[HIGH] Composer Remote Code Execution vulnerability via web-accessible composer.phar

PKSA-m1ph-vmbx-2xd3 CVE-2023-43655 GHSA-jm6m-4632-36hf

Affected version: >=2.3.0,<2.6.4|>=2.0.0,<2.2.22|<1.10.27

Reported by:
GitHub

[HIGH] Missing input validation can lead to command execution in composer

PKSA-6zmq-d6mk-r5wm CVE-2022-24828 GHSA-x7cr-6qr6-2hh6

Affected version: >=2.3,<2.3.5|>=2.0,<2.2.12|<1.10.26

Reported by:
FriendsOfPHP/security-advisories, GitHub

[HIGH] Improper escaping of command arguments on Windows leading to command injection

PKSA-93hy-9dc1-gbwt CVE-2021-41116 GHSA-frqg-7g38-6gcf

Affected version: >=2.0.0-alpha1,<2.1.9|<1.10.23

Reported by:
FriendsOfPHP/security-advisories, GitHub

[HIGH] Missing argument delimiter can lead to command execution via VCS repository URLs or source download URLs on systems with Mercurial

PKSA-9p8h-97x3-qxpm CVE-2021-29472 GHSA-h5h8-pc6h-jvvx

Affected version: >=2.0.0-alpha1,<2.0.13|<1.10.22

Reported by:
FriendsOfPHP/security-advisories, GitHub

[HIGH] Composer Cache Injection vulnerability

PKSA-qx8p-c3v3-6yfg CVE-2015-8371 GHSA-725m-w832-q973

Affected version: <=1.0.0-alpha11

Reported by:
FriendsOfPHP/security-advisories, GitHub