CVE-2024-24821 Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer

High 8.8 Published 8 Feb 2024 Updated 17 Jun 2025

Attackers can execute arbitrary code and escalate privileges by tampering with Composer's local installation files, affecting CLI commands and self-updates.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-24821?

CVE-2024-24821 is a high-severity code injection vulnerability in composer, published on 8 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead to local privilege escalation, provide lateral user movement or malicious code execution when Composer is invoked within a directory with tampered files. All Composer CLI commands are affected, including composer.phar's self-update. The following scenarios are of high risk: Composer being run with sudo, Pipelines which may execute Composer on untrusted projects, Shared environments with developers who run Composer individually on the same project. This vulnerability has been addressed in versions 2.7.0 and 2.2.23. It is advised that the patched versions are applied at the earliest convenience. Where not possible, the following should be addressed: Remove all sudo composer privileges for all users to mitigate root privilege escalation, and avoid running Composer within an untrusted directory, or if needed, verify that the contents of `vendor/composer/InstalledVersions.php` and `vendor/composer/installed.php` do not include untrusted code. A reset can also be done on these files by the following:```sh rm vendor/composer/installed.php vendor/composer/InstalledVersions.php composer install --no-scripts --no-plugins ```

Weakness: CWE-829

Which versions are affected by CVE-2024-24821?

5 open source packages ship an affected version, including composer/composer and composer. It affects 1 product.

Package	Affected	Fixed in
`composer/composer` Packagist	From `2.0.0-alpha1`	`2.2.23`
`composer/composer` Packagist	From `2.0.0-alpha1`	`2.2.23`
`composer/composer` Packagist	From `2.3.0-rc1`	`2.7.0`
`composer/composer` Packagist	From `2.3.0-rc1`	`2.7.0`
`composer` Bitnami	From `2.0.0`	`2.2.23, 2.7.0`

Linux distribution packages (8)

`php-composer2` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	All versions	`2.2.3-150400.3.9.1`
`php-composer2` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	All versions	`2.2.3-150400.3.9.1`
`php-composer2` SUSE:Linux Enterprise Module for Web and Scripting 15 SP5	All versions	`2.2.3-150400.3.9.1`
`php-composer2` SUSE:Linux Enterprise Server 15 SP4-LTSS	All versions	`2.2.3-150400.3.9.1`
`php-composer2` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	All versions	`2.2.3-150400.3.9.1`
`php-composer2` SUSE:Manager Server 4.3	All versions	`2.2.3-150400.3.9.1`
`php-composer2` openSUSE:Leap 15.5	All versions	`2.2.3-150400.3.9.1`
`php-composer2` openSUSE:Tumbleweed	All versions	`2.7.1-1.1`

Products include Getcomposer Composer.

How do I fix CVE-2024-24821?

Upgrade composer/composer to a fixed version for your release line: 2.2.23 or 2.7.0.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-24821 being exploited?

There is no known exploitation of CVE-2024-24821 in the wild and no public exploit code.

Sources

Also known as BIT-composer-2024-24821, CLEANSTART-2024-JY83809, DEBIAN-CVE-2024-24821, DSA-5632-1, GHSA-7c6p-848j-wh5h, SUSE-SU-2024:0592-1 and 2 more.