CVE-2024-35241: Composer

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

Affected products

• Composer Composer: from 2.0, before 2.2.24 (fixed in 2.2.24); from 2.3, before 2.7.7 (fixed in 2.7.7)
• Fedoraproject Fedora: version 39 only; version 40 only
• Getcomposer Composer: from 2.0, before 2.2.24 (fixed in 2.2.24); from 2.3, before 2.7.7 (fixed in 2.7.7)

Published 2024-06-10. Last modified 2026-06-17.