CVE Explorer
CVE-2025-67746
Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be o
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"composer","vendor":"composer","versions":[{"status":"affected","version":">= 2.0, < 2.2.26"},{"status":"affected","version":">= 2.3, < 2.9.3"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:76af3f4b8f6098b641507df93b447b71f31afb8e94b6c3284c1c93c2621b668a · sha256:f272400c28ea3c03… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":1.3,"baseSeverity":"LOW","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:76af3f4b8f6098b641507df93b447b71f31afb8e94b6c3284c1c93c2621b668a · sha256:f272400c28ea3c03… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-74","description":"CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:76af3f4b8f6098b641507df93b447b71f31afb8e94b6c3284c1c93c2621b668a · sha256:f272400c28ea3c03… · /containers/cna/problemTypes/0/descriptions/0
Source references
5 source assertions{"name":"https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917","tags":["x_refsource_MISC"],"url":"https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:76af3f4b8f6098b641507df93b447b71f31afb8e94b6c3284c1c93c2621b668a · sha256:f272400c28ea3c03… · /containers/cna/references/1
{"name":"https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71","tags":["x_refsource_MISC"],"url":"https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:76af3f4b8f6098b641507df93b447b71f31afb8e94b6c3284c1c93c2621b668a · sha256:f272400c28ea3c03… · /containers/cna/references/2
{"name":"https://github.com/composer/composer/releases/tag/2.2.26","tags":["x_refsource_MISC"],"url":"https://github.com/composer/composer/releases/tag/2.2.26"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:76af3f4b8f6098b641507df93b447b71f31afb8e94b6c3284c1c93c2621b668a · sha256:f272400c28ea3c03… · /containers/cna/references/3
{"name":"https://github.com/composer/composer/releases/tag/2.9.3","tags":["x_refsource_MISC"],"url":"https://github.com/composer/composer/releases/tag/2.9.3"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:76af3f4b8f6098b641507df93b447b71f31afb8e94b6c3284c1c93c2621b668a · sha256:f272400c28ea3c03… · /containers/cna/references/4
{"name":"https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g","tags":["x_refsource_CONFIRM"],"url":"https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:76af3f4b8f6098b641507df93b447b71f31afb8e94b6c3284c1c93c2621b668a · sha256:f272400c28ea3c03… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.