Vulnerability-Lookup

CVE-2026-59947 (GCVE-0-2026-59947)

Vulnerability from cvelistv5 – Published: 2026-07-08 19:33 – Updated: 2026-07-09 14:01

Title

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Summary

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 14:01 UTC

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/composer/composer/security/adv…	x_refsource_CONFIRM
https://github.com/composer/composer/commit/6bd66…	x_refsource_MISC
https://github.com/composer/composer/commit/8887a…	x_refsource_MISC
https://github.com/composer/composer/releases/tag…	x_refsource_MISC
https://github.com/composer/composer/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
composer	composer	Affected: >= 1.0, < 2.2.29 Affected: >= 2.3.0, < 2.10.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59947",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:01:31.826906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:01:42.612Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "composer",
          "vendor": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 2.2.29"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.10.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T19:33:56.009Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3"
        },
        {
          "name": "https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8"
        },
        {
          "name": "https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec"
        },
        {
          "name": "https://github.com/composer/composer/releases/tag/2.10.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/releases/tag/2.10.2"
        },
        {
          "name": "https://github.com/composer/composer/releases/tag/2.2.29",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/releases/tag/2.2.29"
        }
      ],
      "source": {
        "advisory": "GHSA-g6xq-892h-64w3",
        "discovery": "UNKNOWN"
      },
      "title": "Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59947",
    "datePublished": "2026-07-08T19:33:56.009Z",
    "dateReserved": "2026-07-07T18:49:15.607Z",
    "dateUpdated": "2026-07-09T14:01:42.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59947",
      "date": "2026-09-19",
      "epss": "0.00144",
      "percentile": "0.0405"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "composer",
                "vendor": "composer",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.0, \u003c 2.2.29"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.3.0, \u003c 2.10.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2."
          }
        ],
        "id": "CVE-2026-59947",
        "lastModified": "2026-07-10T19:10:59.333",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59947",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:01:31.826906Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-08T20:16:59.843",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/releases/tag/2.10.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/releases/tag/2.2.29"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-532"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-29T13:33:05+00:00",
      "cve": "CVE-2026-59947",
      "id": "CVE-2026-59947",
      "initial_release_date": "2026-07-08T19:33:56.009000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "composer/composer: Composer: Information disclosure of credentials via debug output",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59947.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T23:32:04Z",
      "cve": "CVE-2026-59947",
      "id": "CVE-2026-59947",
      "initial_release_date": "2026-07-10T03:11:48Z",
      "product_status:first_fixed": "4",
      "product_status:known_affected": "11",
      "product_status:recommended": "9",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-59947",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-59947.json",
      "version": "6"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59947",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T14:01:31.826906Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T14:01:38.080Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "composer",
              "vendor": "composer",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.0, \u003c 2.2.29"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.3.0, \u003c 2.10.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-532",
                  "description": "CWE-532: Insertion of Sensitive Information into Log File",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T19:33:56.009Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3"
            },
            {
              "name": "https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8"
            },
            {
              "name": "https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec"
            },
            {
              "name": "https://github.com/composer/composer/releases/tag/2.10.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/releases/tag/2.10.2"
            },
            {
              "name": "https://github.com/composer/composer/releases/tag/2.2.29",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/composer/composer/releases/tag/2.2.29"
            }
          ],
          "source": {
            "advisory": "GHSA-g6xq-892h-64w3",
            "discovery": "UNKNOWN"
          },
          "title": "Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-59947",
        "datePublished": "2026-07-08T19:33:56.009Z",
        "dateReserved": "2026-07-07T18:49:15.607Z",
        "dateUpdated": "2026-07-08T19:33:56.009Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-composer-2026-59947

Vulnerability from bitnami_vulndb

Published

2026-07-14 08:40

Modified

2026-07-27 06:08

Summary

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "composer",
        "purl": "pkg:bitnami/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.2.29"
            },
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.10.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59947"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*",
      "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:php:*:*"
    ],
    "severity": "Medium"
  },
  "details": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.",
  "id": "BIT-composer-2026-59947",
  "modified": "2026-07-27T06:08:49.409Z",
  "published": "2026-07-14T08:40:59.896Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.10.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.2.29"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59947"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)"
}

CLEANSTART-2026-KK97612 (CVE-2026-59947)

Vulnerability from cleanstart – Published: 2026-09-18 09:29 – Updated: 2026-09-03 05:48 – Source website

Summary

Security fix for CVE-2026-59947 applied in: composer 2.10.2-r0

Details

Security vulnerability affects the composer package. This issue is resolved in later releases. See references for vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-59947	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59947	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the composer package. This issue is resolved in later releases. See references for vulnerability details.",
  "id": "CLEANSTART-2026-KK97612",
  "modified": "2026-09-03T05:48:18Z",
  "published": "2026-09-18T09:29:16.334079Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KK97612.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59947"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59947"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fix for CVE-2026-59947 applied in: composer 2.10.2-r0",
  "upstream": [
    "CVE-2026-59947"
  ]
}

FKIE_CVE-2026-59947

Vulnerability from fkie_nvd - Published: 2026-07-08 20:16 - Updated: 2026-07-10 19:10

Severity

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8
	security-advisories@github.com	https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec
	security-advisories@github.com	https://github.com/composer/composer/releases/tag/2.10.2
	security-advisories@github.com	https://github.com/composer/composer/releases/tag/2.2.29
	security-advisories@github.com	https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "composer",
          "vendor": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 2.2.29"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.10.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2."
    }
  ],
  "id": "CVE-2026-59947",
  "lastModified": "2026-07-10T19:10:59.333",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59947",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-09T14:01:31.826906Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-08T20:16:59.843",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/releases/tag/2.10.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/releases/tag/2.2.29"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-G6XQ-892H-64W3

Vulnerability from github – Published: 2026-07-20 21:55 – Updated: 2026-07-20 21:55

Summary

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Details

Summary

When Composer is run with -vvv (debug verbosity), it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text. Because GitHub and several other services support placing an access token in the username position of a URL (for example https://[token]@github.com/owner/repo), a token used that way could end up written to the verbose log in full.

This is an information disclosure issue. The credential is only ever exposed to whoever can already read Composer's debug output.

Am I affected?

You are potentially affected only if all of the following apply:

A credential is embedded inside a URL that Composer handles, e.g. in a repositories entry in composer.json, in a package dist/source URL - rather than being supplied through auth.json or the COMPOSER_AUTH environment variable.
The secret sits in the username slot of that URL (e.g. https://TOKEN@host/…). A normal username:password@host pair where the username is an ordinary account name did not expose the password, that was already masked.
Composer is run with -vvv (debug verbosity), and that output is retained or shared somewhere others can read it: public CI build logs, output pasted into an issue or chat, archived terminal sessions, and so on.

If you keep credentials in auth.json or environment variables, or you never run Composer at debug verbosity, you were not exposed.

The most realistic exposure is the documented pattern of embedding a GitHub Personal Access Token in a URL's username position on a machine (often CI) that captures verbose output.

Patched versions

The username is now masked the same way the password already was, so an embedded token no longer appears in verbose output (a short, non-secret prefix may be shown to aid debugging, but never the full value).

Fixed in Composer 2.10.2 and the 2.2.29.

Workarounds

There is no configuration setting that prevents outputting credentials while keeping normal behavior.

If you cannot upgrade right away, you can reduce exposure by:

Not running Composer with -vvv (debug verbosity) in environments where output is captured or shared.
Moving credentials out of URLs and into auth.json or COMPOSER_AUTH.
Scrubbing existing CI/build logs that may already contain a leaked token.

Severity

4.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "composer/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "composer/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.2.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59947"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:55:05Z",
    "nvd_published_at": "2026-07-08T20:16:59Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nWhen Composer is run with -vvv (debug verbosity), it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text. Because GitHub and several other services support placing an access token in the username position of a URL (for example https://[token]@github.com/owner/repo), a token used that way could end up written to the verbose log in full.\n\nThis is an information disclosure issue. The credential is only ever exposed to whoever can already read Composer\u0027s debug output.\n\n## Am I affected?\n\nYou are potentially affected only if **all** of the following apply:\n\n- A credential is embedded inside a URL that Composer handles, e.g. in a `repositories` entry in composer.json, in a package dist/source URL - rather than being supplied through auth.json or the COMPOSER_AUTH environment variable.\n- The secret sits in the username slot of that URL (e.g. `https://TOKEN@host/\u2026`). A normal `username:password@host` pair where the username is an ordinary account name did not expose the password, that was already masked.\n- Composer is run with -vvv (debug verbosity), and that output is retained or shared somewhere others can read it: public CI build logs, output pasted into an issue or chat, archived terminal sessions, and so on.\n\nIf you keep credentials in auth.json or environment variables, or you never run Composer at debug verbosity, you were not exposed.\n\nThe most realistic exposure is the documented pattern of embedding a GitHub Personal Access Token in a URL\u0027s username position on a machine (often CI) that captures verbose output.\n\n## Patched versions\n\nThe username is now masked the same way the password already was, so an embedded token no longer appears in verbose output (a short, non-secret prefix may be shown to aid debugging, but never the full value).\n\nFixed in Composer 2.10.2 and the 2.2.29.\n\n## Workarounds\n\nThere is no configuration setting that prevents outputting credentials while keeping normal behavior.\n\nIf you cannot upgrade right away, you can reduce exposure by:\n\n- Not running Composer with -vvv (debug verbosity) in environments where output is captured or shared.\n- Moving credentials out of URLs and into auth.json or COMPOSER_AUTH.\n- Scrubbing existing CI/build logs that may already contain a leaked token.",
  "id": "GHSA-g6xq-892h-64w3",
  "modified": "2026-07-20T21:55:05Z",
  "published": "2026-07-20T21:55:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59947"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/composer/composer"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.10.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/releases/tag/2.2.29"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)"
}

OPENSUSE-SU-2026:11268-1

Vulnerability from csaf_opensuse - Published: 2026-07-14 00:00 - Updated: 2026-09-17 17:14

Summary

php-composer2-2.10.2-1.1 on GA media

Severity

Moderate

Scope

3 vulnerabilities in this advisory, including CVE-2026-59947.

CVE-2026-59947

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2026:21520-1

Vulnerability from csaf_opensuse - Published: 2026-08-03 21:09 - Updated: 2026-09-17 17:41

Summary

Security update for php-composer2

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-59947.

CVE-2026-59947

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Recommended: 1 product

Open the full advisory

SUSE-SU-2026:23116-1

Vulnerability from csaf_suse - Published: 2026-08-03 21:09 - Updated: 2026-09-16 20:11

Summary

Security update for php-composer2

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-59947.

CVE-2026-59947

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Recommended: 2 products

Open the full advisory

SUSE-SU-2026:23138-1

Vulnerability from csaf_suse - Published: 2026-08-03 21:09 - Updated: 2026-09-16 20:11

Summary

Security update for php-composer2

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-59947.

CVE-2026-59947

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Recommended: 2 products

Open the full advisory

UBUNTU-CVE-2026-59947 (CVE-2026-59947)

Vulnerability from osv_ubuntu – Published: 2026-07-08 20:16 – Updated: 2026-07-15 17:53 – Source website

Details

Severity

4.7 (Medium)


                    
                      CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-59947	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-59947	REPORT
	https://github.com/composer/composer/security/adv…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.0.0~beta2-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.0.0~beta2-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0~alpha10+20150602-1",
        "1.0.0~alpha10+20150602-2",
        "1.0.0~alpha11-1",
        "1.0.0~alpha11-1ubuntu1",
        "1.0.0~alpha11-2",
        "1.0.0~alpha11-3",
        "1.0.0~beta1-1ubuntu1",
        "1.0.0~beta2-1",
        "1.0.0~beta2-1ubuntu0.1~esm1",
        "1.0.0~beta2-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.6.3-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.6.3-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.1-1",
        "1.5.2-1",
        "1.6.2-1",
        "1.6.3-1",
        "1.6.3-1ubuntu0.1~esm1",
        "1.6.3-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.10.1-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.10.1-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.0-2",
        "1.9.1-1",
        "1.9.2-1",
        "1.9.3-1",
        "1.10.0-1",
        "1.10.1-1",
        "1.10.1-1ubuntu0.1~esm1",
        "1.10.1-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.2.6-2ubuntu4+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.2.6-2ubuntu4+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.9-2ubuntu2",
        "2.0.9-2ubuntu3",
        "2.0.13-1ubuntu1",
        "2.1.12-1ubuntu1",
        "2.2.6-2ubuntu4",
        "2.2.6-2ubuntu4+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.7.1-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.7.1-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.8-1",
        "2.6.5-1",
        "2.6.6-1",
        "2.7.1-2",
        "2.7.1-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.8.8-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.8.8-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.8.6-1",
        "2.8.8-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "2.9.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@2.9.5-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.8.8-1",
        "2.9.5-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.",
  "id": "UBUNTU-CVE-2026-59947",
  "modified": "2026-07-15T17:53:45Z",
  "published": "2026-07-08T20:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-59947"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59947"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-59947"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-59947 (GCVE-0-2026-59947)

bit-composer-2026-59947

Vulnerability from bitnami_vulndb

CLEANSTART-2026-KK97612 (CVE-2026-59947)

FKIE_CVE-2026-59947

GHSA-G6XQ-892H-64W3

Summary

Am I affected?

Patched versions

Workarounds

OPENSUSE-SU-2026:11268-1

OPENSUSE-SU-2026:21520-1

SUSE-SU-2026:23116-1

SUSE-SU-2026:23138-1

UBUNTU-CVE-2026-59947 (CVE-2026-59947)

Tags

Sightings

Nomenclature

Related by attack behaviour