CVE-2026-59947
Fixed in a distro release EPSS <1%CVSS 4.7
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
Products: composer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | composer/composer | 2.10.2 |
| Packagist | composer/composer | 2.2.29 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | composer | no fix |
| Debian 13 | composer | no fix |
| Debian 14 | composer | 2.10.2-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP7 | php-composer2 | 2.6.4-150600.3.23.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP7 | php-composer2 | 2.6.4-150600.3.12.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | php-composer2 | 2.6.4-150600.3.12.1 |
| SUSE Linux Enterprise Server 16.0 | php-composer2 | 2.8.9-160000.6.1 |
| SUSE Linux Enterprise Server 16.0 | php-composer2 | 2.8.9-160000.4.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | php-composer2 | 2.2.30-150400.3.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | php-composer2 | 2.6.4-150600.3.12.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | php-composer2 | 2.8.9-160000.6.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | php-composer2 | 2.8.9-160000.4.1 |
| Ubuntu 25.10 | composer | no fix |
| Ubuntu 26.04 LTS | composer | no fix |
| Ubuntu 26.10 | composer | no fix |
| Ubuntu Pro 16.04 LTS | composer | no fix |
| Ubuntu Pro 18.04 LTS | composer | no fix |
| Ubuntu Pro 20.04 LTS | composer | no fix |
| Ubuntu Pro 22.04 LTS | composer | no fix |
| Ubuntu Pro 24.04 LTS | composer | no fix |
| openSUSE Leap 16.0 | php-composer2 | 2.8.9-160000.4.1 |
| openSUSE Leap 16.0 | php-composer2 | 2.8.9-160000.6.1 |
| openSUSE Tumbleweed | php-composer2 | 2.10.2-1.1 |