CVE-2025-67746

Name: CVE-2025-67746
Creator: NVD / NIST
Published: 2025-12-30T16:15:47.17+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

LOWCVSS 1.3/10EPSS 0.40%

Last modified Jun 17, 2026

CVE-2025-67746 is a low-severity vulnerability rated 1.3/10 on the CVSS scale. Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. EPSS estimates a 0.40% chance of exploitation in the next 30 days.

Description

Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.

Metrics

CVSS 3.1

4.3/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS 4.0

1.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.40%

32.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-74

Affected Software

Vendor	Product	Versions
Getcomposer	Composer	>= 2.0.0, < 2.2.26
Getcomposer	Composer	>= 2.3.0, < 2.9.3

References

https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917Patch
https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71Patch
https://github.com/composer/composer/releases/tag/2.2.26Product, Release Notes
https://github.com/composer/composer/releases/tag/2.9.3Product, Release Notes
https://github.com/composer/composer/security/advisories/GHSA-59pp-r3rg-353gVendor Advisory

Timeline

Published: Dec 30, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-67746?

How severe is CVE-2025-67746?

CVE-2025-67746 has a CVSS score of 1.3/10 (LOW severity). The EPSS model estimates a 0.40% probability of exploitation in the next 30 days.

How do I fix CVE-2025-67746?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-67746?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST