Medium 4.3Published Dec 30, 2025

CVE-2025-67746Composer is a dependency manager for PHP.

Updated under an hour ago (2026-10-19 08:10 UTC)

Does this affect you?

It affects getcomposer composer. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for getcomposer composer

Exploited in the last 30 days

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

CVSS: 4.3 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness (CWE): CWE-74
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

getcomposer composer getcomposer:composer	from 2.0.0 before 2.2.26; from 2.3.0 before 2.9.3	NVD

References

https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917patch
https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71patch
https://github.com/composer/composer/releases/tag/2.2.26product, release-notes
https://github.com/composer/composer/releases/tag/2.9.3product, release-notes
https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353gvendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.