PT-2026-40868 · Composer · Composer

CVE-2026-45793 · Published 2026-05-14 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.9.8

Description A validation error in Composer causes GitHub tokens to be leaked into CI/CD logs.

Recommendations Update to version 2.9.8. Audit GitHub Action logs for leaked tokens.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-45793

GHSA-F9F8-RM49-7JV2

Affected Products

Composer

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45793.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-45793.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-f9f8-rm49-7jv2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45793 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45793 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45793 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45793 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45793 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-45793 · Vendor Advisory
• https://github.com/composer/composer/releases/tag/2.9.8 · Note
• https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1 · Note
• https://github.com/composer/composer/releases/tag/2.2.28 · Note
• https://github.com/composer/composer/pull/12853 · Note
• https://github.com/composer/composer/pull/12855 · Note