CVE-2026-45793
Fixed in a distro release EPSS 1%CVSS 7.5
Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.
Products: composer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | composer/composer | 2.9.8 |
| Packagist | composer/composer | 2.2.28 |
| Packagist | composer/composer | 1.10.28 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | composer | 2.5.5-1+deb12u5 |
| Debian 13 | composer | 2.8.8-1+deb13u3 |
| Debian 14 | composer | 2.10.0-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP7 | php-composer2 | 2.6.4-150600.3.23.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP7 | php-composer2 | 2.6.4-150600.3.12.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | php-composer2 | 2.6.4-150600.3.12.1 |
| SUSE Linux Enterprise Server 16.0 | php-composer2 | 2.8.9-160000.4.1 |
| SUSE Linux Enterprise Server 16.0 | php-composer2 | 2.8.9-160000.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | php-composer2 | 2.6.4-150600.3.12.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | php-composer2 | 2.8.9-160000.6.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | php-composer2 | 2.8.9-160000.4.1 |
| Ubuntu Pro 16.04 LTS | composer | no fix |
| Ubuntu Pro 18.04 LTS | composer | no fix |
| Ubuntu Pro 20.04 LTS | composer | no fix |
| openSUSE Leap 16.0 | php-composer2 | 2.8.9-160000.6.1 |
| openSUSE Leap 16.0 | php-composer2 | 2.8.9-160000.4.1 |
| openSUSE Tumbleweed | php-composer2 | 2.10.2-2.1 |