CVE-2026-59947

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.29 Composer versions prior to 2.10.2

Description When run with -vvv debug verbosity, the software may print credentials embedded in the username slot of a repository or package URL (for example, a GitHub Personal Access Token in https://TOKEN@host/) to the debug output. This occurs because the AuthHelper, Url::sanitize, and ProcessExecutor functions do not sanitize username-only URL credentials.

Recommendations Update to version 2.2.29 or later. Update to version 2.10.2 or later.