AIKIDO-2026-10803
composer/composer is vulnerable to Information Disclosure
75
High Risk
This Affects:
composer/composerTL;DR
composer leaks GitHub OAuth tokens to stderr when token validation fails. A regex used to validate GitHub tokens rejects newer GitHub Actions GITHUB_TOKEN formats containing - characters, causing the full token to be included in exception messages and exposed in CI logs. The issue mainly affects GitHub Actions environments where tokens are automatically configured in Composer. Exposure is limited by the short lifetime and repository scope of GITHUB_TOKEN values, but other credentials failing validation could also be leaked.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
composer/composer is vulnerable to Information Disclosure in versions 2.3.0 - 2.9.7, 2.0.0 - 2.2.27 and 1.0.0 - 1.10.27.
How to fix this
Upgrade the composer/composer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant