PT-2026-40868 · Composer · Composer

CVE-2026-45793 · Publicado 2026-05-14 · Atualizado 2026-07-15

Positive Technologies (AI Summary) · Pt

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Nome do Software Vulnerável e Versões Afetadas Composer versões anteriores a 2.9.8

Descrição Um erro de validação no Composer faz com que tokens do GitHub sejam expostos nos logs de CI/CD.

Recomendações Atualize para a versão 2.9.8. Audite os logs do GitHub Action em busca de tokens expostos.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-45793

GHSA-F9F8-RM49-7JV2

Produtos afetados

Composer

Referências · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45793.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-45793.yaml · Exploit
• https://github.com/composer/composer/releases/tag/2.9.8 · Nota
• https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1 · Nota
• https://github.com/composer/composer/releases/tag/2.2.28 · Nota
• https://github.com/composer/composer/pull/12853 · Nota
• https://github.com/composer/composer/pull/12855 · Nota
• https://github.com/composer/composer/releases/tag/1.10.28 · Nota
• https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039 · Nota
• https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2 · Nota
• https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714 · Nota
• https://github.com/composer/composer · Nota
• https://reddit.com/r/VulnMatter/comments/1ths5us/resumen_diario_de_vulnerabilidades_19052026 · Publicação no Reddit
• https://twitter.com/the_yellow_fall/status/2054722115706802327 · Publicação no Twitter
• https://twitter.com/SecureChap/status/2054956386178543677 · Publicação no Twitter