Composer 2.7 and CVE-2024-24821: Code execution and possible privilege escalation

Published by

blog.packagist.com

on •1 min read

Composer 2.7 and CVE-2024-24821: Code execution and possible privilege escalation

Please immediately update Composer to version 2.7.0 or 2.2.23 (composer.phar self-update). The new releases includes fixes for a code execution and possible privilege escalation via InstalledVersions.php or installed.php vulnerability (CVE-2024-24821) reported by Ed Cradock.

Composer Security Dependencies Update

Learn more