Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-45793Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

High 7.5

In plain English

A high-severity information exposure in composer from composer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.0%top 36.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	composer	2.9.8-r0	ALPINE-CVE-2026-45793
Debian:12	composer	2.5.5-1+deb12u5	DEBIAN-CVE-2026-45793
Debian:13	composer	2.8.8-1+deb13u3	DEBIAN-CVE-2026-45793
Debian:14	composer	2.10.0-1	DEBIAN-CVE-2026-45793
Packagist	composer/composer	1.10.28	GHSA-f9f8-rm49-7jv2
Packagist	composer/composer	2.9.8	GHSA-f9f8-rm49-7jv2
Packagist	composer/composer	2.2.28	GHSA-f9f8-rm49-7jv2

Affected products (as reported)

Vendor	Product	Versions
composer	composer	>= 1.0, < 1.10.28>= 2.0.0, < 2.2.28>= 2.3.0, < 2.9.8

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2 x_refsource_CONFIRM
https://github.com/composer/composer/pull/12853 x_refsource_MISC
https://github.com/composer/composer/pull/12855 x_refsource_MISC
https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039 x_refsource_MISC
https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1 x_refsource_MISC
https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714 x_refsource_MISC
https://github.com/composer/composer/releases/tag/1.10.28 x_refsource_MISC
https://github.com/composer/composer/releases/tag/2.2.28 x_refsource_MISC
https://github.com/composer/composer/releases/tag/2.9.8 x_refsource_MISC