CVE-2025-67746

Composer 2.x is vulnerable to ANSI sequence injection in terminal output when downloading from remote sources. Affected: 2.2.x before 2.2.26 and 2.9.x before 2.9.3. Root cause: remote sources can inject ANSI control characters into command output, potentially causing mangled output and terminal D...