CVE-2026-59944
1 advisory.
Packagist/composer/composer CVE-2026-59944: medium 6.1, EPSS 0.47%
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
Action: Upgrade composer/composer to 2.2.30 or later.
composer require composer/composer:2.10.3composer require composer/composer:2.2.30Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.3.0 | 2.10.3 | - |
| 1.0 | 2.2.30 | - |
Fixed versions
| 2.10.3 | 2.2.30 |
Sources
- osv: GHSA-96h3-5x6v-m776
- https://github.com/composer/composer/security/advisories/GHSA-96h3-5x6v-m776
- https://nvd.nist.gov/vuln/detail/CVE-2026-59944
- https://github.com/composer/composer/commit/53b8bb4c24697b2f00a18cf1ef35a10392701b89
- https://github.com/composer/composer/commit/ad649fdfdf8ed826d4a34e0e5690c76a0b4833aa
- https://github.com/composer/composer
- https://github.com/composer/composer/releases/tag/2.10.3
- https://github.com/composer/composer/releases/tag/2.2.30
CVE-2026-59944 · published · modified · JSON