Vulnerability · Published Oct 5, 2021 · Assigned by GitHub_M
CVE-2021-41116Command injection in composer on Windows
High 8.2
In plain English
A high-severity command injection in composer from composer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | composer | 2.1.9-r0 | ALPINE-CVE-2021-41116 |
| Alpine:v3.21 | composer | 2.1.9-r0 | ALPINE-CVE-2021-41116 |
| Alpine:v3.22 | composer | 2.1.9-r0 | ALPINE-CVE-2021-41116 |
| Alpine:v3.23 | composer | 2.1.9-r0 | ALPINE-CVE-2021-41116 |
| Alpine:v3.24 | composer | 2.1.9-r0 | ALPINE-CVE-2021-41116 |
| Packagist | composer/composer | 1.10.23 | GHSA-frqg-7g38-6gcf |
| Packagist | composer/composer | 2.1.9 | GHSA-frqg-7g38-6gcf |
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N