CVE-2022-24828

CVE-2022-24828 is a code injection vulnerability in Composer, a PHP dependency manager, affecting integrators that use VcsDriver::getFileContent with user-controlled input. This flaw could allow attackers to inject parameters into version control systems like Mercurial or Git, potentially leading to a supply chain attack. The vulnerability carries a high CVSS score of 8.8, indicating a critical risk with network-based attacks, low attack complexity, and high impact on confidentiality, integrity, and availability. While Composer itself is not directly affected, integrators like Packagist.org were vulnerable, though patches were deployed quickly. There is no evidence of active exploitation, and no public exploit code is available, but it has garnered some community and media attention.