{"action":"Upgrade composer/composer to 1.10.28 or later.","affected":[{"fixed":"2.9.8","introduced":"2.3.0"},{"fixed":"2.2.28","introduced":"2.0.0"},{"fixed":"1.10.28","introduced":"1.0"}],"component":"composer/composer","cve_ids":["CVE-2026-45793"],"ecosystem":"Packagist","epss":0.01021,"exploited":false,"fixed_versions":["2.9.8","2.2.28","1.10.28"],"ghsa_id":"GHSA-f9f8-rm49-7jv2","id":"tcs_01M5KF1N83WNRSV3GGYDP76RKF","modified_at":"2026-07-20T21:26:45.763823920Z","published_at":"2026-05-19T16:17:58Z","references":["https://osv.dev/vulnerability/GHSA-f9f8-rm49-7jv2","https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://nvd.nist.gov/vuln/detail/CVE-2026-45793","https://github.com/composer/composer/pull/12853","https://github.com/composer/composer/pull/12855","https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039","https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1","https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714","https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-45793.yaml","https://github.com/composer/composer","https://github.com/composer/composer/releases/tag/1.10.28","https://github.com/composer/composer/releases/tag/2.2.28","https://github.com/composer/composer/releases/tag/2.9.8"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-f9f8-rm49-7jv2","url":"https://osv.dev/vulnerability/GHSA-f9f8-rm49-7jv2"}],"summary":"Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs"}