AIKIDO-2026-625824

TL;DR

When Composer installs a package it changes the file mode of each entry declared in the package bin field so it becomes executable. If a bin entry contains .. path segments, it resolves to a path outside the package install directory, letting a malicious or compromised dependency make Composer chmod an arbitrary existing host file to a world-readable and world-executable mode. This runs during normal install, update, and require, is triggered by any direct or transitive dependency, and is not blocked by --no-scripts, --no-plugins, or allow-plugins. The fix rejects any package whose binary entry contains a .. segment and aborts before any permission is changed.