CVE-2024-24821

CVE-2024-24821 is a local privilege escalation vulnerability affecting Composer, the PHP dependency manager, in versions prior to 2.7.0 and 2.2.23. It allows arbitrary code execution when Composer is invoked in a directory with tampered files, potentially leading to root privilege escalation, lateral movement, or malicious code execution. Rated with a CVSS score of 7.8 (High), this vulnerability has a low attack complexity and requires local access but no user interaction. While there is no evidence of active exploitation, public exploit code, or significant community discussion, immediate patching is advised, or mitigation strategies like removing sudo Composer privileges and verifying vendor files should be implemented.