PatchSiren cyber security CVE debrief
CVE-2026-59947 composer CVE debrief
CVE-2026-59947 is a medium-severity vulnerability in Composer, a dependency manager for PHP. When run with -vvv debug verbosity, Composer could print credentials embedded in repository or package URLs, such as GitHub Personal Access Tokens, to debug output. This issue was fixed in versions 2.2.29 and 2.10.2. The vulnerability affects developers using Composer for dependency management in PHP projects, who should check if their version is vulnerable and update to a fixed version if necessary.
- Vendor
- composer
- Product
- Unknown
- CVSS
- MEDIUM 4.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-08
- Original CVE updated
- 2026-07-10
- Advisory published
- 2026-07-08
- Advisory updated
- 2026-07-10
Who should care
Developers using Composer for dependency management in PHP projects should check if their version is vulnerable and update to a fixed version if necessary. They should also review and sanitize debug output for sensitive information and limit access to Composer and debug output.
Technical summary
Composer, a dependency manager for PHP, had a vulnerability where it would print credentials in debug output when run with -vvv verbosity. This was due to insufficient sanitization of username-only URL credentials by AuthHelper, Url::sanitize, and ProcessExecutor. The issue was addressed in versions 2.2.29 and 2.10.2. Affected developers should review and sanitize debug output for sensitive information and limit access to Composer and debug output.
Defensive priority
Medium
Recommended defensive actions
- Update Composer to version 2.2.29 or 2.10.2
- Review and sanitize debug output for sensitive information
- Limit access to Composer and debug output
- Monitor for suspicious activity in PHP projects
- Perform a thorough review of Composer configurations and usage
- Implement additional logging and monitoring for Composer activity
- Consider using alternative dependency managers for PHP projects
Evidence notes
The CVE record was published on 2026-07-08T20:16:59.843Z and last modified on 2026-07-10T19:10:59.333Z. The NVD entry is currently Deferred. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and review official advisories for specific guidance.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-08T20:16:59.843Z and has not been modified since then. The NVD entry is currently Deferred.