CVE-2026-59947— Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59947
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Source: CVE Program / CVE List V5
Vulnerability Description
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Composer 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Composer是Composer组织开源的一个应用软件。提供一个声明,管理和安装PHP项目的依赖项。 Composer 2.2.29之前版本和2.3.0至2.10.2之前版本存在日志信息泄露漏洞，该漏洞源于AuthHelper、Url::sanitize和ProcessExecutor未对仅包含用户名的URL凭据进行清理，当以-vvv调试详细程度运行时，会在调试输出中打印存储库或包URL用户名中的凭据（如GitHub Personal Access Token），导致敏感信息泄露。以下版本受到影响：2.
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-59947
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59947
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59947 (3)
- 🔗 Release 2.10.2 · composer/composer · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-59947 (1)
Vendor Pages for CVE-2026-59947 (1)
- 🔗 Release 2.2.29 · composer/composer · GitHubx_refsource_MISC
Same Patch Batch · composer · 2026-07-08 · 3 CVEs total
| CVE-2026-59948 | 7.0 HIGH | Composer: Arbitrary file write outside vendor via malicious transitive package name |
| CVE-2026-59946 | 6.1 MEDIUM | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files |
IV. Related Vulnerabilities
Same product: composer
- CVE-2026-45793
Composer: Github Actions issued GITHUB_TOKEN disclosure in G - CVE-2026-11914
Composer - Critical - Unsupported - SA-CONTRIB-2026-046 - CVE-2026-59948
Composer: Arbitrary file write outside vendor via malicious - CVE-2026-59946
Composer: Path traversal in package bin field lets dependenc - CVE-2026-10043
MosaicML Composer Deserialization of Untrusted Data Remote C
Same vendor: composer
- CVE-2026-45793
Composer: Github Actions issued GITHUB_TOKEN disclosure in G - CVE-2026-59948
Composer: Arbitrary file write outside vendor via malicious - CVE-2026-59946
Composer: Path traversal in package bin field lets dependenc - CVE-2026-40261
Composer has Command Injection via Malicious Perforce Refere - CVE-2026-40176
Composer is vulnerable to Command Injection via Malicious Pe
Same weakness: CWE-532
- CVE-2026-64800
JetBrains GoLand<2026.2日志敏感配置信息泄露漏洞 - CVE-2026-65589
n8n before 1.123.64 Credential Exposure via LLM Node Executi - CVE-2026-62211
OpenClaw < 2026.6.1 Credential Redaction Bypass via Trajecto - CVE-2026-46514
Frogman: Plaintext passwords and secrets persisted to audit - CVE-2026-44969
dbt-mcp: Tool Arguments Including SQL Queries and Credential
V. Comments for CVE-2026-59947
No comments yet