PT-2025-54191 · Composer+2 · Composer+2

Seldaek · Published 2025-01-01 · Updated 2026-03-05 · CVE-2025-67746

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.26 Composer versions prior to 2.9.3

Description Composer, a dependency manager for PHP, may allow attackers who control remote sources from which Composer downloads to inject ANSI control characters into the terminal output of various Composer commands. This can result in distorted output and potentially cause a denial-of-service condition for the terminal application. There is no known exploit for this issue, but it is considered potentially abusable.

Recommendations Update to Composer version 2.2.26 or later. Update to Composer version 2.9.3 or later.

Exploit

Fix

DoS

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2026-03590

BIT-COMPOSER-2025-67746

CVE-2025-67746

GHSA-59PP-R3RG-353G

OPENSUSE-SU-2026:10054-1

OPENSUSE-SU-2026:20670-1

RHSA-2026:8165

SUSE-SU-2026:0825-1

SUSE-SU-2026:0935-1

SUSE-SU-2026:1970-1

SUSE-SU-2026:21542-1

Affected Products

Composer

Debian

Red Os

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67746.json · Exploit
• https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71 · Patch
• https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353g · Vendor Advisory
• https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917 · Patch
• https://osv.dev/vulnerability/GHSA-59pp-r3rg-353g · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-67746 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67746 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0825-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-67746 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-67746 · Security Note
• https://ubuntu.com/security/CVE-2025-67746 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-67746 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10054-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-67746 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03590 · Security Note