CVE-2026-59947 Details
Description
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
A vulnerability in Composer, a PHP dependency manager, allows for the unintentional disclosure of sensitive credentials, such as GitHub Personal Access Tokens, when URLs containing these tokens are processed by Composer. This issue arises because, prior to versions 2.2.29 and 2.10.2, Composer did not properly sanitize username-only URL credentials in its debug output. The vulnerability is present in Composer versions 2.3.0 prior to 2.10.2 and 1.0 through 2.2.28.
Users can upgrade to Composer versions 2.10.2 or 2.2.29, where this vulnerability has been patched. For those unable to upgrade immediately, it's advisable to avoid running Composer with debug verbosity in environments where the output could be shared or logged, and to move credentials out of URLs and into the auth.json file or the COMPOSER_AUTH environment variable.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8 | [email protected] | Source CodeVendor |
| https://github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec | [email protected] | Source CodeVendor |
| https://github.com/composer/composer/releases/tag/2.10.2 | [email protected] | BundleRelease NotesVendor |
| https://github.com/composer/composer/releases/tag/2.2.29 | [email protected] | Release NotesVendor |
| https://github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Composer | >= 2.3.0, < 2.10.2 (semver) >= 1.0, < 2.2.29 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |