Specially crafted branch names in Git repositories can execute code
CVE-2024-35241
8.8HIGH
What is CVE-2024-35241?
The vulnerability CVE-2024-35241 affects the Composer, a widely used PHP dependency manager, and allows the execution of malicious code with specially crafted Git repository branch names. It impacts versions prior to 2.2.24 for 2.2 LTS or 2.7.7 for mainline. There is no known exploitation by ransomware groups. Patches are available and users are recommended to update to the latest versions to mitigate these vulnerabilities. Additionally, users are advised to avoid installing dependencies via git and to carefully review the sources of software packages to ensure system integrity.
Affected Version(s)
composer >= 2.0, < 2.2.24 < 2.0, 2.2.24
composer >= 2.3, < 2.7.7 < 2.3, 2.7.7
Sentiguard