CyberRota Analysis
AI-GeneratedComposer versions prior to 2.2.29 and 2.10.2 are vulnerable to exposing sensitive credentials, such as GitHub Personal Access Tokens, in debug output when run with high verbosity. This could lead to unauthorized access if these tokens are inadvertently shared or logged. Developers and organizations using Composer for PHP dependency management should prioritize upgrading to the latest versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.