Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21520-1 advisory.

    - CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).
    - CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files     (bsc#1271151).
    - CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).
    - CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name     (bsc#1271122).

    Changes for php-composer2:

    - fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3105-1 advisory.

    - CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).
    - CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files     (bsc#1271151).
    - CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).
    - CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name     (bsc#1271122).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1800 advisory.

    Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs (CVE-2026-45793)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8,     Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and     interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using     the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs.
    This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8. (CVE-2026-45793)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8,
    Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and
    interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using
    the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs.
    This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8. (CVE-2026-45793)

ID	Name	Product	Family	Type	Severity
332103	openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21520-1)	Nessus	SuSE Local Security Checks	Local	medium
327741	SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:3105-1)	Nessus	SuSE Local Security Checks	Local	medium
319799	Amazon Linux 2023 : composer (ALAS2023-2026-1800)	Nessus	Amazon Linux Local Security Checks	Local	high
316398	Linux Distros Unpatched Vulnerability : CVE-2026-45793	Nessus	Misc.	Local	high
442151	SCA: security update for composer/composer (GHSA-f9f8-rm49-7jv2)	Tenable Cloud Security	SCA Checks	Local	high
442151	SCA: security update for composer/composer (GHSA-f9f8-rm49-7jv2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-45793

high

Tenable Plugins

medium

medium

high

high

high

high