Project: 
Composer
Date: 
2026-June-10
Security risk: 
Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All
Vulnerability: 
Unsupported
Affected versions: 
*
CVE IDs: 
CVE-2026-11914
Description: 

The security team is marking the Composer module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Note: this is about a project for the Drupal system that makes use of composer. It is not a vulnerability in the composer software itself.

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...