{"action":"Upgrade composer/composer to 2.2.23 or later.","affected":[{"fixed":"2.2.23","introduced":"2.0.0-alpha1"},{"fixed":"2.7.0","introduced":"2.3.0-rc1"}],"component":"composer/composer","cve_ids":["CVE-2024-24821"],"ecosystem":"Packagist","epss":0.00279,"exploited":false,"fixed_versions":["2.2.23","2.7.0"],"ghsa_id":"GHSA-7c6p-848j-wh5h","id":"tcs_01M5KEXXYYW5VR6MAJ95ASPJM3","modified_at":"2026-09-10T03:50:09.776708786Z","published_at":"2024-02-08T15:06:38Z","references":["https://osv.dev/vulnerability/GHSA-7c6p-848j-wh5h","https://github.com/composer/composer/security/advisories/GHSA-7c6p-848j-wh5h","https://nvd.nist.gov/vuln/detail/CVE-2024-24821","https://github.com/composer/composer/commit/64e4eb356b159a30c766cd1ea83450a38dc23bf5","https://github.com/composer/composer/commit/77e3982918bc1d886843dc3d5e575e7e871b27b7","https://github.com/composer/composer"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-7c6p-848j-wh5h","url":"https://osv.dev/vulnerability/GHSA-7c6p-848j-wh5h"}],"summary":"Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php"}