High severity8.8OSV Advisory· Published Jun 10, 2024· Updated Apr 15, 2026
CVE-2024-35241
CVE-2024-35241
Description
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using --prefer-dist or the preferred-install: dist config setting.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
composer/composerPackagist | >= 2.0, < 2.2.24 | 2.2.24 |
composer/composerPackagist | >= 2.3, < 2.7.7 | 2.7.7 |
Affected products
15- osv-coords14 versionspkg:apk/chainguard/composerpkg:apk/wolfi/composerpkg:bitnami/composerpkg:composer/composer/composerpkg:rpm/opensuse/php-composer2&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/php-composer2&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/php-composer2&distro=openSUSE%20Tumbleweedpkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP5pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP6pkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/php-composer2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/php-composer2&distro=SUSE%20Manager%20Server%204.3
< 2.7.7-r0+ 13 more
- (no CPE)range: < 2.7.7-r0
- (no CPE)range: < 2.7.7-r0
- (no CPE)range: >= 2.0.0, < 2.2.24
- (no CPE)range: >= 2.0, < 2.2.24
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.6.4-150600.3.3.1
- (no CPE)range: < 2.7.7-1.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.6.4-150600.3.3.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.2.3-150400.3.12.1
- (no CPE)range: < 2.2.3-150400.3.12.1
Patches
Vulnerability mechanics
References
11- github.com/advisories/GHSA-47f6-5gq3-vx9cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-35241ghsaADVISORY
- github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4nvdWEB
- github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704nvdWEB
- github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9cnvdWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MCghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHCghsaWEB
- www.vicarius.io/vsociety/posts/cve-2024-35241-detect-composer-vulnerabilitynvdWEB
- www.vicarius.io/vsociety/posts/cve-2024-35241-mitigate-vulnerable-composernvdWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC/nvd
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC/nvd
News mentions
0No linked articles in our index yet.