CVE-2024-35242: Composer

High severity, CVSS 8.8. EPSS: 3.3% chance of exploitation in the next 30 days.

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Affected products

• Composer Composer: from 2.0, before 2.2.24 (fixed in 2.2.24); from 2.3, before 2.7.7 (fixed in 2.7.7)
• Fedoraproject Fedora: version 39 only; version 40 only
• Getcomposer Composer: from 2.0, before 2.2.24 (fixed in 2.2.24); from 2.3, before 2.7.7 (fixed in 2.7.7)

Published 2024-06-10. Last modified 2026-06-17.