CVE-2025-67746: 
PHP vulnerability analysis and mitigation

CVE-2025-67746 is an ANSI sequence injection vulnerability in Composer, the PHP dependency manager. Attackers who control remote package sources that Composer downloads from can inject ANSI control characters into the terminal output of various Composer commands, causing mangled output and potentially leading to user confusion or denial of service of the terminal application. The vulnerability affects all Composer 2.x releases from 2.0.0 up to (but not including) 2.2.26, and from 2.3.0 up to (but not including) 2.9.3. It was disclosed on December 30, 2025, with patches released the same day. The CVSS v3.1 base score is 4.3 (Medium), and the CVSS v4.0 base score is 1.3 (Low) (GitHub Advisory).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74). Composer's ConsoleIO class passed messages from remote sources — such as package metadata, advisory data, and interactive prompts — directly to terminal output functions (write, writeError, and question helpers) without sanitizing ANSI escape sequences or other control characters. An attacker controlling a malicious package repository or Composer package source could embed ANSI CSI sequences (e.g., \x1B[...), OSC sequences, or raw control characters in package names, descriptions, or advisory text, which would then be rendered by the terminal. The fix introduced a ConsoleIO::sanitize() static method that strips ANSI escape sequences (CSI, OSC, and simple ESC sequences) and non-printable control characters before any output is written (GitHub Advisory, Patch Commit 2.9.x, Patch Commit 2.2.x).

Successful exploitation is limited in scope: an attacker controlling a remote Composer package source can corrupt or mangle terminal output seen by developers running Composer commands, potentially causing confusion about the state of dependency installation or security advisories. In a worst case, injected sequences such as cursor movement or screen-clearing commands could cause denial of service of the terminal application itself. There is no impact on confidentiality or integrity of the host system, and no code execution or data exfiltration is possible through this vulnerability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The Composer maintainers explicitly noted there is no proven exploit and rated the severity as low, publishing the CVE proactively to inform users. The EPSS score is approximately 0.017% (very low probability of exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to control a remote source that the victim's Composer installation downloads from, such as a malicious or compromised package repository (GitHub Advisory).

Users should upgrade Composer to version 2.2.26 (for the 2.2.x LTS branch) or 2.9.3 (for the mainline 2.3+ branch). Both releases were published on December 30, 2025, and contain the ConsoleIO::sanitize() fix that strips ANSI escape sequences and control characters from all terminal output. No configuration-based workaround is available; upgrading is the only remediation. Additionally, organizations should restrict Composer to trusted, vetted package repositories to reduce exposure to malicious remote sources (Composer 2.2.26 Release, Composer 2.9.3 Release).

The Composer maintainer (Jordi Boggiano / Seldaek) proactively published the advisory and CVE despite no proven exploit, citing a desire to be transparent and encourage users to upgrade. The advisory credits reporter cs278 for discovering the issue. Downstream Linux distributions including Debian, Fedora, SUSE, and openSUSE issued their own security advisories and updated their packaged versions of Composer in January–March 2026 (Composer 2.9.3 Release, GitHub Advisory).