Packagist/composer/composer CVE-2024-24821: high 8.8, EPSS 0.28%

Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php

Action: Upgrade composer/composer to 2.2.23 or later.

composer require composer/composer:2.2.23

composer require composer/composer:2.7.0

Affected

Fixed versions

Sources

• osv: GHSA-7c6p-848j-wh5h
• https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h
• https://nvd.nist.gov/vuln/detail/CVE-2024-24821
• https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5
• https://github.com/composer/composer/commit/77e3982918bc1d886843dc3d5e575e7e871b27b7
• https://github.com/composer/composer

CVE-2024-24821 · published 2024-02-08T15:06:38Z · modified 2026-09-10T03:50:09.776708786Z · JSON