https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T06:58:22.991482+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2024-35242 CVE-2024-35242 — Composer vulnerable to command injection via malicious git/hg branch names 2026-10-02T06:58:22.993772+00:00

Affected: composer, fedoraproject fedora, getcomposer composer

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.