Log in Start free

Vulnerability · Published Dec 30, 2025 · Assigned by GitHub_M

CVE-2025-67746Composer vulnerable to ANSI sequence injection

Low 1.3

In plain English

A low-severity injection in composer from composer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)1.3Low
Exploit odds (30 days)0.5%top 60.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23composer2.9.3-r0ALPINE-CVE-2025-67746
Alpine:v3.24composer2.9.3-r0ALPINE-CVE-2025-67746
Debian:12composer2.5.5-1+deb12u3DEBIAN-CVE-2025-67746
Debian:13composer2.8.8-1+deb13u1DEBIAN-CVE-2025-67746
Debian:14composer2.9.3-1DEBIAN-CVE-2025-67746
Packagistcomposer/composer2.9.3GHSA-59pp-r3rg-353g
Packagistcomposer/composer2.2.26GHSA-59pp-r3rg-353g
Ubuntu:25.10composerno fix listedUBUNTU-CVE-2025-67746
Ubuntu:26.04:LTScomposerno fix listedUBUNTU-CVE-2025-67746

Affected products (as reported)

VendorProductVersions
composer composer >= 2.0, < 2.2.26>= 2.3, < 2.9.3

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References