GitHub Advisoryadvisory · Packagist
GHSA-frqg-7g38-6gcf Improper escaping of command arguments on Windows leading to command injection
HIGH
Official page ↗
- Aliases
- CVE-2021-41116
- Ecosystem
- Packagist
- Packages
- composer/composer
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- Weaknesses
- CWE-77
- Reviewed
- 2021-10-05
Affected packages
• Packagist composer/composer: < 1.10.23 → fixed in 1.10.23
• Packagist composer/composer: >= 2.0.0-alpha1, < 2.1.9 → fixed in 2.1.9
Description
Impact
Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected.
Patches
1.10.23 and 2.1.9 fix the issue
Workarounds
None
Related
Alias · CVE (1)
- CVE-2021-41116 Composer is an open source dependency manager for the PHP language. vulnerability
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness
References
- https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf web
- https://nvd.nist.gov/vuln/detail/CVE-2021-41116 advisory
- https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-41116.yaml web
- https://github.com/composer/composer package
- https://www.sonarsource.com/blog/securing-developer-tools-package-managers web
- https://www.tenable.com/security/tns-2022-09 web