Composer CVE-2026-59947

Exploitation requires two concurrent conditions: Composer must be invoked with the -vvv (triple-verbose) debug flag, and at least one repository or package source must be configured with a credential embedded in the URL userinfo component (e.g., https://TOKEN@host/ format). This is not a default Composer configuration - the -vvv flag is explicitly user- or pipeline-supplied. Exploitation is limited by the need for the attacker to have access to the debug output, which may be a terminal session, log file, or CI/CD artifact store. The vulnerability does not affect Composer invocations without -vvv, nor does it affect credentials supplied via separate auth configuration files (auth.json) rather than inline URL embedding.

The NVD CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the constrained exploitation conditions: local access, high complexity due to the non-default -vvv flag requirement, and low-privilege execution. The confidentiality impact is rated High because leaked credentials (GitHub PATs, registry tokens) grant durable, out-of-band access to private repositories or package registries - far beyond just reading a file. However, the real-world risk is significantly shaped by CI/CD deployment patterns: -vvv is commonly enabled in build pipelines for debugging, and log artifacts are frequently stored in artifact repositories or shared dashboards, potentially widening exposure beyond strictly local access. No EPSS data was provided, and there is no KEV listing or public POC, suggesting no confirmed active exploitation. The primary risk is passive credential harvesting from stored logs rather than active targeted exploitation. CVSS attack complexity 'High' is appropriate given the non-default flag requirement, though in CI environments where verbose logging is standard practice, the effective complexity is closer to Low.

A developer or CI/CD pipeline invokes Composer with -vvv to debug a package resolution failure against a private GitHub registry configured with a PAT in the URL (https://TOKEN@github.com/org/repo). Composer prints the unsanitized URL to stdout, which is captured in the CI/CD build log. A threat actor with read access to the artifact repository or shared log dashboard extracts the PAT and uses it to clone private repositories or push malicious packages. No public exploit code is required - the leak occurs passively during legitimate tool usage.