Magento 2 Composer.lock Audit
Built for Magento agencies and maintainers. Upload a composer.lock and get a client-ready PDF: outdated/vulnerable modules, CVE mapping, vendor risk summary, core status, and upgrade recommendations.
This audit analyzes only what is recorded in your composer.lock file.
If your Magento instance modifies core files, applies patches manually, or bypasses Composer, the audit cannot detect those changes.
PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
Algolia Search & Discovery for Magento 2 Has Untrusted Data Handling
libsodium has Incomplete List of Disallowed Inputs
Composer is vulnerable to ANSI sequence injection
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Magento vulnerable to stored Cross-Site Scripting (XSS)
Magento provides incorrect authorization through a security feature bypass
Magento vulnerable to stored Cross-Site Scripting (XSS)
Magento vulnerable to privilege escalation due to incorrect authorization
Magento allows incorrect authorization
Magento Community Edition Improper Input Validation vulnerability
Magento Cross-Site Request Forgery (CSRF) vulnerability
Magento has incorrect authorization issue that leads to arbitrary file system read
Magento Cross-site Scripting vulnerability
Magento vulnerable to path traversal
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Magento vulnerable to denial of service
No scans yet
Upload a composer.lock to create the first scan and watch it move from pending -> running -> finished.
FAQ
Tap to toggle answers. Questions are extra large for quick scanning.
