Cloudanix VulnDB

CVE-2025-67746

Medium · 4.3

CVSS

4.3

EPSS

0.5%

Published

Dec 30, 2025

CISA due date

—

The record

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

Affected packages

Ecosystem Package Introduced Fixed
Packagist composer/composer 2.0.0 2.2.26
Packagist composer/composer 2.3.0 2.9.3
Bitnami composer 2.0.0 2.2.26
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 php-composer2 0 2.6.4-150600.3.6.1
openSUSE:Leap 15.6 php-composer2 0 2.6.4-150600.3.6.1
openSUSE:Tumbleweed php-composer2 0 2.9.3-1.1
packagist composer/composer 2.0.0 2.2.26
packagist composer/composer 2.3.0 2.9.3

Related vulnerabilities