Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2099

NIXPKGS-2026-2099
published 2 weeks, 6 days ago
phpPackages.composer: security issues < 2.10.2
Permalink CVE-2026-59947
4.7 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 2 weeks, 6 days ago by @LeSuisse Activity log
  • Created suggestion 2 weeks, 6 days ago
  • @LeSuisse ignored
    13 packages
    • subtitlecomposer
    • composer-require-checker
    • haskellPackages.gogol-composer
    • phpPackages.cyclonedx-php-composer
    • php82Packages.cyclonedx-php-composer
    • php83Packages.cyclonedx-php-composer
    • php84Packages.cyclonedx-php-composer
    • php85Packages.cyclonedx-php-composer
    • phpPackages.composer-local-repo-plugin
    • php82Packages.composer-local-repo-plugin
    • php83Packages.composer-local-repo-plugin
    • php84Packages.composer-local-repo-plugin
    • php85Packages.composer-local-repo-plugin
    2 weeks, 6 days ago
  • @LeSuisse accepted 2 weeks, 6 days ago
  • @LeSuisse published on GitHub 2 weeks, 6 days ago
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.

Affected products

composer
  • ==>= 1.0, < 2.2.29
  • ==>= 2.3.0, < 2.10.2

Matching in nixpkgs

Ignored packages (13)

pkgs.composer-require-checker

CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

Package maintainers

Permalink CVE-2026-59948
7.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 2 weeks, 6 days ago by @LeSuisse Activity log
  • Created suggestion 2 weeks, 6 days ago
  • @LeSuisse ignored
    13 packages
    • subtitlecomposer
    • composer-require-checker
    • haskellPackages.gogol-composer
    • phpPackages.cyclonedx-php-composer
    • php82Packages.cyclonedx-php-composer
    • php83Packages.cyclonedx-php-composer
    • php84Packages.cyclonedx-php-composer
    • php85Packages.cyclonedx-php-composer
    • phpPackages.composer-local-repo-plugin
    • php82Packages.composer-local-repo-plugin
    • php83Packages.composer-local-repo-plugin
    • php84Packages.composer-local-repo-plugin
    • php85Packages.composer-local-repo-plugin
    2 weeks, 6 days ago
  • @LeSuisse accepted 2 weeks, 6 days ago
  • @LeSuisse published on GitHub 2 weeks, 6 days ago
Composer: Arbitrary file write outside vendor via malicious transitive package name

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project during install or update by using an invalid package name that is not correctly validated before dependency-resolution results are written or installed. This issue is fixed in versions 2.2.29 and 2.10.2.

Affected products

composer
  • ==>= 1.0, < 2.2.29
  • ==>= 2.3.0, < 2.10.2

Matching in nixpkgs

Ignored packages (13)

pkgs.composer-require-checker

CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

Package maintainers

Permalink CVE-2026-59946
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): Low (L)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): None (N)
updated 2 weeks, 6 days ago by @LeSuisse Activity log
  • Created suggestion 2 weeks, 6 days ago
  • @LeSuisse ignored
    13 packages
    • subtitlecomposer
    • composer-require-checker
    • haskellPackages.gogol-composer
    • phpPackages.cyclonedx-php-composer
    • php82Packages.cyclonedx-php-composer
    • php83Packages.cyclonedx-php-composer
    • php84Packages.cyclonedx-php-composer
    • php85Packages.cyclonedx-php-composer
    • phpPackages.composer-local-repo-plugin
    • php82Packages.composer-local-repo-plugin
    • php83Packages.composer-local-repo-plugin
    • php84Packages.composer-local-repo-plugin
    • php85Packages.composer-local-repo-plugin
    2 weeks, 6 days ago
  • @LeSuisse accepted 2 weeks, 6 days ago
  • @LeSuisse published on GitHub 2 weeks, 6 days ago
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and world-executable mode during composer install, update, or require. This issue is fixed in versions 2.2.29 and 2.10.2.

Affected products

composer
  • ==>= 1.0, < 2.2.29
  • ==>= 2.3.0, < 2.10.2

Matching in nixpkgs

Ignored packages (13)

pkgs.composer-require-checker

CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies

Package maintainers