CVE-2025-67746— Composer vulnerable to ANSI sequence injection
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-67746
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Composer vulnerable to ANSI sequence injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Composer 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Composer是Composer开源的一个应用软件。提供一个声明，管理和安装PHP项目的依赖项。 Composer 2.2.26之前版本和2.9.3之前版本存在注入漏洞，该漏洞源于攻击者可能注入ANSI控制字符，可能导致终端输出混乱或拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-67746
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-67746
请登录查看更多情报信息。
- https://github.com/composer/composer/releases/tag/2.9.3x_refsource_MISC
- https://github.com/composer/composer/releases/tag/2.2.26x_refsource_MISC
- https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353gx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2025-67746
IV. Related Vulnerabilities
Same product: composer
- CVE-2026-40261
Composer has Command Injection via Malicious Perforce Refere - CVE-2026-40176
Composer is vulnerable to Command Injection via Malicious Pe - CVE-2024-35242
Composer vulnerable to command injection via malicious git/h - CVE-2024-35241
Composer vulnerable to command injection via malicious git b - CVE-2024-24821
Code execution and possible privilege escalation via comprom
Same vendor: composer
- CVE-2026-40261
Composer has Command Injection via Malicious Perforce Refere - CVE-2026-40176
Composer is vulnerable to Command Injection via Malicious Pe - CVE-2024-35242
Composer vulnerable to command injection via malicious git/h - CVE-2024-35241
Composer vulnerable to command injection via malicious git b - CVE-2024-24821
Code execution and possible privilege escalation via comprom
Same weakness: CWE-74
- CVE-2025-67486
Dolibarr has an Authenticated Remote Code Execution via eval - CVE-2026-26164
M365 Copilot Information Disclosure Vulnerability - CVE-2026-7045
baomidou dynamic-datasource StandardEvaluationContext/SpelEx - CVE-2026-6994
Envoy Query Parameter header_mutation.cc params.add injectio - CVE-2026-41319
MailKit has STARTTLS Response Injection via unflushed stream
V. Comments for CVE-2025-67746
No comments yet