Composer, a PHP dependency manager, had a vulnerability where running it with very verbose debug output (-vvv) could cause credentials embedded in the username field of URLs (e.g., https://TOKEN@host/) to be printed in debug logs. This was due to insufficient sanitization by AuthHelper, Url::sanitize, and ProcessExecutor components. The vulnerability affects multiple Ubuntu-packaged versions of Composer prior to 2.2.29 and 2.10.2. The issue is resolved in these fixed versions.

The vulnerability can lead to unintended disclosure of sensitive credentials such as personal access tokens in debug output, which could be accessed by unauthorized users with access to these logs. There is no impact on integrity or availability reported. The attack vector requires local access with low privileges and high attack complexity, and no user interaction is needed.

Upgrade Composer to version 2.2.29 or later, or 2.10.2 or later, where this issue is fixed. Since this is a local information disclosure vulnerability triggered by debug verbosity, limiting debug output and controlling access to debug logs can reduce exposure until patched.