View online: https://www.drupal.org/sa-contrib-2026-046 Project: Composer [1] Date: 2026-June-10 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-11914 Description: The security team is marking the Composer module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] /Note: this is about a project for the Drupal system that makes use of composer. It is not a vulnerability in the composer software itself./ Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] ------------------------------------------------------------------------------ Contribution record [5] [1] https://www.drupal.org/project/composer [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-maintai... [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-maintai... [5] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....