CVE-2025-67746 — Injection in Composer

CWE-74 — Injection8 documents7 sources
Severity
1.3LOWNVD
EPSS
0.0%
top 91.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
ComposerGetcomposer Composer
Timeline
PublishedDec 30

Description

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be o…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages4 packages

▶Packagistcomposer/composer2.0.0 — 2.2.26+1
▶NVDgetcomposer/composer2.0.0 — 2.2.26+1
▶Debiancomposer/composer< 2.5.5-1+deb12u3+2
▶CVEListV5composer/composer>= 2.0, < 2.2.26, >= 2.3, < 2.9.3+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
CVEList
Composer vulnerable to ANSI sequence injection↗2025-12-30
▶
OSV
CVE-2025-67746: Composer is a dependency manager for PHP↗2025-12-30
▶
OSV
Composer is vulnerable to ANSI sequence injection↗2025-12-30
▶
GHSA
Composer is vulnerable to ANSI sequence injection↗2025-12-30
▶

📋Vendor Advisories

2
Red Hat
composer: Composer: Terminal output manipulation leading to Denial of Service↗2025-12-30
▶
Debian
CVE-2025-67746: composer - Composer is a dependency manager for PHP. In versions on the 2.x branch prior to...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-67746 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-67746 — Injection in Getcomposer Composer | cvebase