CVE-2021-41116
Command injection in composer on Windows
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Command injection in composer on Windows
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
- Record
CVE-2021-41116- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2021-2198
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
- Record
EUVD-2021-2198- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-frqg-7g38-6gcf
Improper escaping of command arguments on Windows leading to command injection
Impact
Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected.
Patches
1.10.23 and 2.1.9 fix the issue
Workarounds
None
- Record
GHSA-frqg-7g38-6gcf- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
NVD
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
- Record
CVE-2021-41116- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-41116
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
- Record
ALPINE-CVE-2021-41116- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
- Record
CVE-2021-41116- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-frqg-7g38-6gcf
Improper escaping of command arguments on Windows leading to command injection
Impact
Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected.
Patches
1.10.23 and 2.1.9 fix the issue
Workarounds
None
- Record
GHSA-frqg-7g38-6gcf- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-41116
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
- Record
UBUNTU-CVE-2021-41116- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-composer-2021-41116 No score
Command injection in composer on Windows
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
- Record
BIT-composer-2021-41116- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0132-1 No score
Security update for php-composer
This update for php-composer fixes the following issues:
php-composer was updated to version 1.10.26:
- Security: Fixed command injection vulnerability in HgDriver/GitDriver: CVE-2022-24828 boo#1198494
Update to version 1.10.25
- Fix regression with PHP 8.1.0 and 8.1.1
Update to version 1.10.24
- Fixed PHP 8.1 compatibility
Update to version 1.10.23
- Security: Fixed command injection vulnerability CVE-2021-41116
- Record
openSUSE-SU-2022:0132-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11617-1 No score
php-composer2-2.1.12-1.1 on GA media
These are all security issues fixed in the php-composer2-2.1.12-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11617-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11874-1 No score
php-composer-1.10.25-1.1 on GA media
These are all security issues fixed in the php-composer-1.10.25-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11874-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
composer/composerPackagist |
before 1.10.23 | 1.10.23 |
composer/composerPackagist |
2.0.0-alpha1 up to 2.1.9 | 2.1.9 |
composerAlpine:v3.14 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerAlpine:v3.15 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerAlpine:v3.16 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerAlpine:v3.17 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerAlpine:v3.18 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerAlpine:v3.19 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerAlpine:v3.20 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerAlpine:v3.21 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
composerAlpine:v3.22 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerAlpine:v3.23 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerAlpine:v3.24 |
2.0.0 up to 2.1.9-r0 | 2.1.9-r0 |
composerBitnami |
before 1.10.23, 2.0.0 up to 2.1.9 | 1.10.232.1.9 |
composer/composerPackagist |
before 1.10.23, plus listed versions 1.0.01.0.0-alpha11.0.0-alpha101.0.0-alpha111.0.0-alpha2 Show 45 moreShow less1.0.0-alpha31.0.0-alpha41.0.0-alpha51.0.0-alpha61.0.0-alpha71.0.0-alpha81.0.0-alpha91.0.0-beta11.0.0-beta21.0.11.0.21.0.31.1.01.1.0-RC1.1.11.1.21.1.31.10.01.10.0-RC1.10.11.10.101.10.111.10.121.10.131.10.141.10.151.10.161.10.171.10.181.10.191.10.21.10.201.10.211.10.221.10.31.10.41.10.51.10.61.10.71.10.81.10.91.2.01.2.0-RC1.2.11.2.2 |
1.10.23 |
composer/composerPackagist |
2.0.0-alpha1 up to 2.1.9, plus listed versions 2.0.02.0.0-RC12.0.0-RC22.0.0-alpha22.0.0-alpha3 Show 24 moreShow less2.0.12.0.102.0.112.0.122.0.132.0.142.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.0-RC12.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.8 |
2.1.9 |
composerUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.0.0~alpha10+20150602-11.0.0~alpha10+20150602-21.0.0~alpha11-11.0.0~alpha11-1ubuntu11.0.0~alpha11-2 Show 5 moreShow less1.0.0~alpha11-31.0.0~beta1-1ubuntu11.0.0~beta2-11.0.0~beta2-1ubuntu0.1~esm11.0.0~beta2-1ubuntu0.1~esm2 |
None known |
php-composerSUSE:Package Hub 15 SP3 From an advisory covering 2 CVEs |
before 1.10.26-bp153.2.6.1 | 1.10.26-bp153.2.6.1 |
php-composeropenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 1.10.26-bp153.2.6.1 | 1.10.26-bp153.2.6.1 |
php-composer2openSUSE:Tumbleweed |
before 2.1.12-1.1 | 2.1.12-1.1 |
php-composeropenSUSE:Tumbleweed |
before 1.10.25-1.1 | 1.10.25-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-41116 is a high vulnerability (CVSS 8.2) in Composer, published October 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in composer/composer 1.10.23.
References
github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf
sonarsource.com/blog/securing-developer-tools-package-managers
nvd.nist.gov/vuln/detail/CVE-2021-41116
tenable.com/security/tns-2022-09
Show 9 moreShow less
security.alpinelinux.org/vuln/CVE-2021-41116
ubuntu.com/security/CVE-2021-41116
cve.org/CVERecord?id=CVE-2021-41116
lists.opensuse.org/archives/list/[email protected]/thread/GK3MSPNLXNEQ4P7QF5ZJB6IK4W6YAUKM
bugzilla.suse.com/1198494
suse.com/security/cve/CVE-2021-41116
Left out here: 41 versions. The JSON record has them.