CVE-2026-45793

Published: Jul 15, 2026Modified: Jul 15, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (9)

https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039

Source: security-advisories@github.com

https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1

Source: security-advisories@github.com

https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714

Source: security-advisories@github.com

https://github.com/composer/composer/pull/12853

Source: security-advisories@github.com

https://github.com/composer/composer/pull/12855

Source: security-advisories@github.com

https://github.com/composer/composer/releases/tag/1.10.28

Source: security-advisories@github.com

https://github.com/composer/composer/releases/tag/2.2.28

Source: security-advisories@github.com

https://github.com/composer/composer/releases/tag/2.9.8

Source: security-advisories@github.com

https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2

Source: security-advisories@github.com

Timeline

No history available yet.