CVE-2022-24828

Name of the Vulnerable Software and Affected Versions Composer (affected versions not specified)

Description The issue is related to the VcsDriver::getFileContent method in Composer, a dependency manager for PHP. If a user can control the $file or $identifier argument, it may lead to a code injection vulnerability. This vulnerability can be exploited on platforms like packagist.org, where the readme field in composer.json can be used to inject parameters into hg/Mercurial via the $file argument or into git via the $identifier argument. To the best of our knowledge, this vulnerability was not actively exploited. The vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.