composer/composer · Security
Improper escaping of command arguments on Windows leading to command injection
- GHSA ID
- GHSA-frqg-7g38-6gcf
- CVE ID
- CVE-2021-41116
- Severity
- high
- Published
- Updated
- CVSS
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
- CVSS v3
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Description
Impact
Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected.
Patches
1.10.23 and 2.1.9 fix the issue
Workarounds
None
CWEs
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
References
- https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf ↗
- https://nvd.nist.gov/vuln/detail/CVE-2021-41116 ↗
- https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa ↗
- https://www.tenable.com/security/tns-2022-09 ↗
- https://www.sonarsource.com/blog/securing-developer-tools-package-managers/ ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-41116.yaml ↗
- https://github.com/advisories/GHSA-frqg-7g38-6gcf ↗