Composer 2.11.2 and 2.2.32 Fix Command Execution, File Write and Credential Leak Flaws
Do Son 
TL;DR
The Composer team published three security advisories on November 10, 2026, for the PHP dependency manager. Two of these Composer vulnerabilities carry a CVSS score of 8.8 and can lead to code execution. The third, rated 6.5, can leak private repository credentials. Composer 2.11.2 and 2.2.32 fix all three.
A tampered composer.lock file can make Composer run system commands or send repository tokens to an attacker’s host. A malicious package archive can also write files outside the package folder. Upgrade to Composer 2.11.2, or 2.2.32 on the LTS line.
Why It Matters
Composer is the main dependency manager for PHP and often runs inside CI pipelines. Moreover, the most serious flaw needs no malicious package at all. The advisory warns that “the command runs before any checksum or integrity check.” Still, no CVE IDs have been assigned yet, and no exploitation or public exploit has been reported.
How the Attack Works
Command execution from the lock file (GHSA-jhfp-4ppm-crmm, CVSS 8.8)
Composer 2.10.0 through 2.11.1 loaded a download-time callback option straight from composer.lock or installed.json. As a result, a crafted entry can trigger an arbitrary command during install or update. Notably, “–no-scripts and –no-plugins do not prevent it.” According to the maintainers, the most likely route is CI that runs composer install on an unreviewed pull request.
File write via zip archives (GHSA-w6hj-6587-3jh5, CVSS 8.8)
A crafted zip archive can use symlinked entries to place files outside the package directory. This can overwrite a front controller and lead to code execution. However, it requires the unzip command, the PHP zip extension and an untrusted repository or mirror. Composer notes that typical Packagist-only installs “are not a realistic vector.”
Credential leak to mirrors (GHSA-x82q-x274-r6pq, CVSS 6.5)
Some projects send a token in an inline HTTP header to a private repository. In that setup, a crafted lock file can add a download mirror on an attacker’s host. Composer then sends the token to that host.
Affected Versions
- Command execution: Composer 2.10.0 to 2.11.1
- Zip file write: Composer 1.0 to 2.2.31, and 2.3.0 to 2.11.1
- Credential leak: Composer 2.11.0, 2.11.1 and 2.2.31
Patch and Mitigation
Run composer self-update to install 2.11.2, or 2.2.32 for the LTS branch. For all three Composer vulnerabilities, the team says “the only complete fix is upgrading.” Until then, review every lock-file change before CI installs it, and avoid untrusted mirrors.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
