EN PT-BR
← Voltar ao feed
high

Composer 2.11.2 e 2.2.32 corrigem execução de comandos via composer.lock adulterado, escrita de arquivos e vazamento de credenciais

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 11:34 · coletado há 2 horas

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

On 10 November 2026 the Composer maintainers published three security advisories and released Composer 2.11.2 and 2.2.32 (LTS) to fix them (securityonline.info). The headline flaw, GHSA-jhfp-4ppm-crmm, is rated CVSS 8.8 and lets a crafted composer.lock or vendor/composer/installed.json run an arbitrary command during install or update (securityonline.info). The other two cover a zip-based file write and a leak of repository credentials to attacker-controlled mirrors, the latter rated CVSS 6.5 (securityonline.info). Exploitation requires a tampered lock file to reach the project, no CVE ID has been assigned, and no exploitation or public exploit has been reported (securityonline.info). The vendor's own GHSA page could not be retrieved during research, so the severity and version ranges here rest on the news report, and no fix pull request was located.

Entenda a falha

A vulnerabilidade

Composer, the PHP dependency manager, has three flaws with no CVE ID. The worst is GHSA-jhfp-4ppm-crmm (CVSS 8.8, per securityonline.info). In Composer 2.10.0 to 2.11.1, a crafted composer.lock or vendor/composer/installed.json can run an arbitrary command during install or update. The second is a zip-based file write in Composer 1.0 to 2.2.31 and 2.3.0 to 2.11.1. The third is GHSA-x82q-x274-r6pq (CVSS 6.5), which leaks repository credentials in 2.11.0, 2.11.1 and 2.2.31. The attacker needs a tampered lock file to reach the project. Fixes are in Composer 2.11.2 and 2.2.32 (LTS). The severity and version ranges come only from the news report, because the vendor advisory could not be retrieved.

Como funciona

When a developer or CI job runs composer install or update, Composer reads composer.lock or vendor/composer/installed.json to decide what to download and from where. In the command-execution flaw, a download-time callback option was taken straight from those files, so a crafted entry made Composer run a command. This happens before any checksum or integrity check, and the --no-scripts and --no-plugins flags do not stop it. In the credential leak, a crafted lock file adds a download mirror on an attacker's host, and Composer then sends repository tokens to it. The maintainers say the most likely route is CI running composer install on an unreviewed pull request.

Por que é vulnerável

The main cause is that Composer trusted data in composer.lock and installed.json as if it were safe. It accepted a download callback option from the lock entry without restriction and acted on it before verifying integrity. The credential leak follows a similar pattern: the lock file could set a download mirror, and repository tokens were then sent to it. The articles do not explain why this went unnoticed or detail the code change. The fix is in 2.11.2 and 2.2.32, and no fix pull request was located.

Onde está

The articles name no file or function in Composer's code, only the composer.lock and vendor/composer/installed.json inputs and the advisories GHSA-jhfp-4ppm-crmm and GHSA-x82q-x274-r6pq.

Como foi descoberta

The articles do not say who found the flaws or how. The Composer maintainers published three security advisories on 10 November 2026 together with the 2.11.2 and 2.2.32 releases. No CVE ID has been assigned, and no exploitation in the wild has been reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:18.

Detalhes técnicos

  • GHSA-jhfp-4ppm-crmm (CVSS 8.8): Composer 2.10.0 through 2.11.1 loaded a download-time callback option directly from composer.lock or installed.json, so a crafted entry triggers a command during install or update. The --no-scripts and --no-plugins flags do not stop it, and the command runs before any checksum or integrity check (securityonline.info).
  • Zip file write: affected versions are Composer 1.0 to 2.2.31 and 2.3.0 to 2.11.1 (securityonline.info).
  • Credential leak (GHSA-x82q-x274-r6pq, CVSS 6.5): affects Composer 2.11.0, 2.11.1 and 2.2.31. A crafted lock file adds a download mirror on an attacker host, which then receives repository tokens (securityonline.info).
  • According to the maintainers, the most likely route is CI running composer install on an unreviewed pull request (securityonline.info).

Remediação

  • Upgrade to Composer 2.11.2, or to 2.2.32 on the LTS line, through composer self-update (securityonline.info).
  • Until the upgrade is in place, avoid running composer install in CI on unreviewed pull requests or untrusted branches, and review changes to composer.lock and vendor/composer/installed.json before any Composer command runs (analyst recommendation).
  • Rotate repository tokens that were used on hosts that processed untrusted lock files, and search repository history for lock files with unexpected download mirror or callback entries (analyst recommendation).

Linha do tempo

  1. securityonline.info ↗ · pub. 10/11/2026 11:34 · coletado 10/11 13:01 primeiro registro só resumo do feed

    Composer 2.11.2 e 2.2.32 corrigem execução de comandos via composer.lock adulterado, escrita de arquivos e vazamento de credenciais

    ler a análise desta fonte

    On 10 November 2026 the Composer maintainers published three security advisories and released Composer 2.11.2 and 2.2.32 (LTS) to fix them (securityonline.info). The headline flaw, GHSA-jhfp-4ppm-crmm, is rated CVSS 8.8 and lets a crafted composer.lock or vendor/composer/installed.json run an arbitrary command during install or update (securityonline.info). The other two cover a zip-based file write and a leak of repository credentials to attacker-controlled mirrors, the latter rated CVSS 6.5 (securityonline.info). Exploitation requires a tampered lock file to reach the project, no CVE ID has been assigned, and no exploitation or public exploit has been reported (securityonline.info). The vendor's own GHSA page could not be retrieved during research, so the severity and version ranges here rest on the news report, and no fix pull request was located.

    Technical Details

    • GHSA-jhfp-4ppm-crmm (CVSS 8.8): Composer 2.10.0 through 2.11.1 loaded a download-time callback option directly from composer.lock or installed.json, so a crafted entry triggers a command during install or update. The --no-scripts and --no-plugins flags do not stop it, and the command runs before any checksum or integrity check (securityonline.info).
    • Zip file write: affected versions are Composer 1.0 to 2.2.31 and 2.3.0 to 2.11.1 (securityonline.info).
    • Credential leak (GHSA-x82q-x274-r6pq, CVSS 6.5): affects Composer 2.11.0, 2.11.1 and 2.2.31. A crafted lock file adds a download mirror on an attacker host, which then receives repository tokens (securityonline.info).
    • According to the maintainers, the most likely route is CI running composer install on an unreviewed pull request (securityonline.info).

    Remediation

    • Upgrade to Composer 2.11.2, or to 2.2.32 on the LTS line, through composer self-update (securityonline.info).
    • Until the upgrade is in place, avoid running composer install in CI on unreviewed pull requests or untrusted branches, and review changes to composer.lock and vendor/composer/installed.json before any Composer command runs (analyst recommendation).
    • Rotate repository tokens that were used on hosts that processed untrusted lock files, and search repository history for lock files with unexpected download mirror or callback entries (analyst recommendation).