GHSA-59pp-r3rg-353g
NoneCVSS
—
EPSS
—
Published
Dec 30, 2025
CISA due date
—
The record
Composer is vulnerable to ANSI sequence injection
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | composer/composer | 2.0.0 | 2.2.26 |
| Packagist | composer/composer | 2.3.0 | 2.9.3 |
| Bitnami | composer | 2.0.0 | 2.2.26 |
| packagist | composer/composer | 2.0.0 | 2.2.26 |
| packagist | composer/composer | 2.3.0 | 2.9.3 |
Related vulnerabilities
- CVE-2025-67746 Composer is a dependency manager for PHP. Same vulnerability
- CVE-2024-35242 Composer is a dependency manager for PHP. Also affects composer/composer
- CVE-2024-35241 Composer is a dependency manager for PHP. Also affects composer/composer
- CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-74
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-74
- CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to… CWE-74
- CVE-2026-112141 A vulnerability was determined in satya-vinay Events-Management-System up to… CWE-74
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-74