CyberRota Analysis
AI-GeneratedComposer versions prior to 1.10.28, 2.2.28, and 2.9.8 are vulnerable due to improper validation of GitHub OAuth tokens, which can lead to sensitive token information being exposed in error logs. This vulnerability could allow unauthorized access to GitHub resources if exploited, making it critical for developers and organizations using Composer for PHP dependency management to upgrade to the patched versions immediately. Prioritization is essential for teams utilizing GitHub Actions to mitigate potential security risks associated with token exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.