The advisory reports an input‑validation weakness (CWE‑20) in Composer as used within Drupal projects, but the specific malicious action is not disclosed beyond the phrase "allows .". The limited description indicates that untrusted input could be interpreted by Composer in a way that alters its handling of configuration or dependency data. Because the flaw targets Composer’s parser rather than a direct execution path, the primary consequence is a potential compromise of the integrity of Composer input and the configuration it produces, rather than immediate remote code execution or denial of service.

All Drupal Composer instances appear to be vulnerable, as the affected‑version field lists the wildcard *.*. This includes any Drupal site or project that uses Composer to install or update modules, themes, or libraries – from local development machines and CI pipelines to production deployment servers.

The EPSS score is < 1 % and the vulnerability is not listed in CISA’s KEV catalog, implying no publicly documented exploits. The CVSS base score of 5.9 places it in the medium severity range. Based on the inherent nature of an input‑validation flaw and the lack of a stated remote trigger, the likely attack vector requires local or deployment‑time access to run Composer commands – for example, an attacker who can execute Composer in the project environment or supply a crafted composer.json file. Given these conditions, overall risk is moderate, but the potential impact on configuration integrity warrants attention.