Skip to content
Sign in
7.5 High

CVE-2026-45793 Composer is a dependency Manager for the PHP language

Description

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

Affected products and versions

Product Affected versions Fixed in
composer 2.3 2.3.0 → < 2.9.8 2.9.8
composer 2.0 2.0.0 → < 2.2.28 2.2.28
composer 1.0 1.0 → < 1.10.28 1.10.28

Other CVEs of composer

The 16 CVEs of composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Medium CVE-2026-84361 Composer is a dependency Manager for the PHP language 7.7 High CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Medium CVE-2026-59948 Composer is a dependency Manager for the PHP language 7.0 High
Track this CVE