Composer fixes command execution and credential theft flaws

Composer has issued three security advisories on 10 November 2026 addressing critical flaws in the PHP dependency manager. Two of the vulnerabilities carry CVSS scores of 8.8 and enable remote code execution, while a third carries a CVSS of 6.5 and can leak private repository credentials. The fixes are delivered in Composer 2.11.2 and 2.2.32 on the main and LTS lines, respectively.

The advisories warn that the most severe issues can execute commands or exfiltrate tokens without requiring a malicious package to be installed, and that the command can run before any checksum or integrity checks.

Details of the three flaws include: (1) command execution from the lock file (GHSA-jhfp-4ppm-crmm, CVSS 8.8), where a crafted entry in composer[.]lock or installed.json can trigger arbitrary commands during install or update, even with --no-scripts or --no-plugins enabled; (2) file write via crafted zip archives (GHSA-w6hj-6587-3jh5, CVSS 8.8), where a zip archive can place

files outside the package directory using symlinked entries, potentially overwriting a front controller and enabling code execution; and (3) credential leakage to mirrors (GHSA-x82q-x274-r6pq, CVSS 6.5), where a crafted lock file can cause a download mirror to be added and cause the repository token to be sent to an attacker’s host.

Affected versions are listed as: command execution in Composer 2.10.0–2.11.1; zip write in Composer 1.0–2.2.31 and 2.3.0–2.11.1; credential leak in Composer 2.11.0, 2.11.1 and 2.2.31. The publisher advises upgrading to 2.11.2 or 2.2.32 and to review lock-file changes before CI installs, avoiding untrusted mirrors until patches are applied.