CVE-2021-41116highCWE-77

CVE-2021-41116: high-severity vulnerability in composer

Command injection in composer on Windows

Published · Updated

Follow this CVE+ Monitor composer+ Monitor composer/composer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 2.8%
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected products
composer · composer
Related CVEs — composer

In the same product, most dangerous first.

CVE-2021-29472HIGHMissing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composerEPSS 4.8%CVE-2024-35242HIGHComposer vulnerable to command injection via malicious git/hg branch namesEPSS 3.3%CVE-2022-24828HIGHMissing input validation can lead to command execution in composerEPSS 1.9%CVE-2026-40261HIGHComposer has Command Injection via Malicious Perforce ReferenceEPSS 1.7%CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.5%CVE-2024-35241HIGHComposer vulnerable to command injection via malicious git branch nameEPSS 1.1%