CVE-2025-67746

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.26 Composer versions prior to 2.9.3

Description Composer, a dependency manager for PHP, may allow attackers who control remote sources from which Composer downloads to inject ANSI control characters into the terminal output of various Composer commands. This can result in distorted output and potentially cause a denial-of-service condition for the terminal application. There is no known exploit for this issue, but it is considered potentially abusable.

Recommendations Update to Composer version 2.2.26 or later. Update to Composer version 2.9.3 or later.