{"id":"CVE-2021-41116","aliases":["ALPINE-CVE-2021-41116","BIT-composer-2021-41116","EUVD-2021-2198","GHSA-frqg-7g38-6gcf","UBUNTU-CVE-2021-41116","openSUSE-SU-2022:0132-1","openSUSE-SU-2024:11617-1","openSUSE-SU-2024:11874-1"],"status":"published","title":"Command injection in composer on Windows","description":"Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.02825,"percentile":0.86786,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2021-10-05T17:40:10Z","modified":"2026-11-03T06:31:47Z","fixes":[{"ecosystem":"Packagist","package":"composer/composer","fixed_in":["1.10.23","2.1.9"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.14","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"composer","fixed_in":["2.1.9-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"composer","fixed_in":["1.10.23","2.1.9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"php-composer2","fixed_in":["2.1.12-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"php-composer","fixed_in":["1.10.25-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.23"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-alpha1"},{"fixed":"2.1.9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.9-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"composer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.23"},{"introduced":"2.0.0"},{"fixed":"2.1.9"}]}]},{"source":"osv","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.23"}]}],"versions":["1.0.0","1.0.0-alpha1","1.0.0-alpha10","1.0.0-alpha11","1.0.0-alpha2","1.0.0-alpha3","1.0.0-alpha4","1.0.0-alpha5","1.0.0-alpha6","1.0.0-alpha7","1.0.0-alpha8","1.0.0-alpha9","1.0.0-beta1","1.0.0-beta2","1.0.1","1.0.2","1.0.3","1.1.0","1.1.0-RC","1.1.1","1.1.2","1.1.3","1.10.0","1.10.0-RC","1.10.1","1.10.10","1.10.11","1.10.12","1.10.13","1.10.14","1.10.15","1.10.16","1.10.17","1.10.18","1.10.19","1.10.2","1.10.20","1.10.21","1.10.22","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.2.0","1.2.0-RC","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.0-RC","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.6.0","1.6.0-RC","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.0-RC","1.7.1","1.7.2","1.7.3","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.9.0","1.9.1","1.9.2","1.9.3"]},{"source":"osv","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-alpha1"},{"fixed":"2.1.9"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-alpha1","2.0.0-alpha2","2.0.0-alpha3","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-RC1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0~alpha10+20150602-1","1.0.0~alpha10+20150602-2","1.0.0~alpha11-1","1.0.0~alpha11-1ubuntu1","1.0.0~alpha11-2","1.0.0~alpha11-3","1.0.0~beta1-1ubuntu1","1.0.0~beta2-1","1.0.0~beta2-1ubuntu0.1~esm1","1.0.0~beta2-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"php-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.26-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"php-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.26-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php-composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.25-1.1"}]}]}],"products":[{"vendor":"composer","product":"composer"},{"vendor":"getcomposer","product":"composer"},{"vendor":"tenable","product":"tenable.sc"}],"references":[{"url":"https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://www.sonarsource.com/blog/securing-developer-tools-package-managers/","tags":["x_refsource_MISC","x_transferred","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41116","tags":["web","advisory"]},{"url":"https://www.tenable.com/security/tns-2022-09","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-41116.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-frqg-7g38-6gcf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-41116","tags":["advisory"]},{"url":"https://github.com/composer/composer","tags":["package"]},{"url":"https://www.sonarsource.com/blog/securing-developer-tools-package-managers","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-41116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41116","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GK3MSPNLXNEQ4P7QF5ZJB6IK4W6YAUKM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198494","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24828","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-41116","title":"Command injection in composer on Windows","description":"Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.","status":"published","published":"2021-10-05T17:40:10Z","modified":"2024-08-04T02:59:31.44Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-2198","description":"Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.","status":"published","published":"2021-10-05T17:40:10Z","modified":"2024-08-04T02:59:31Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T03:24:19.242491Z"}],"ghsa":[{"id":"GHSA-frqg-7g38-6gcf","title":"Improper escaping of command arguments on Windows leading to command injection","description":"### Impact\nWindows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected. \n\n### Patches\n1.10.23 and 2.1.9 fix the issue\n\n### Workarounds\nNone\n","status":"published","published":"2021-10-05T20:23:18Z","modified":"2024-02-05T10:33:39Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:37:35.293818Z"}],"nvd":[{"id":"CVE-2021-41116","description":"Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.","status":"published","published":"2021-10-05T18:15:08.407Z","modified":"2026-06-17T04:07:54.19Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:06:59.314106Z"}],"osv":[{"id":"ALPINE-CVE-2021-41116","description":"Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.","status":"published","published":"2021-10-05T18:15:08.407Z","modified":"2026-11-03T06:31:47.222390546Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2021-41116","description":"Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.","status":"published","published":"2021-10-05T18:15:08.407Z","modified":"2026-10-20T10:54:57.315058524Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"GHSA-frqg-7g38-6gcf","title":"Improper escaping of command arguments on Windows leading to command injection","description":"### Impact\nWindows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected. \n\n### Patches\n1.10.23 and 2.1.9 fix the issue\n\n### Workarounds\nNone\n","status":"published","published":"2021-10-05T20:23:18Z","modified":"2026-07-08T06:29:33.018363297Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"UBUNTU-CVE-2021-41116","description":"Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.","status":"published","published":"2021-10-05T18:15:00Z","modified":"2025-09-08T16:47:22Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"BIT-composer-2021-41116","title":"Command injection in composer on Windows","description":"Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.","status":"published","published":"2024-03-06T10:51:26.107Z","modified":"2026-09-08T08:45:59.769997221Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"openSUSE-SU-2022:0132-1","title":"Security update for php-composer","description":"This update for php-composer fixes the following issues:\n\nphp-composer was updated to version 1.10.26:\n\n* Security: Fixed command injection vulnerability in\n  HgDriver/GitDriver: CVE-2022-24828 boo#1198494\n\nUpdate to version 1.10.25\n\n* Fix regression with PHP 8.1.0 and 8.1.1\n\nUpdate to version 1.10.24\n\n* Fixed PHP 8.1 compatibility\n\nUpdate to version 1.10.23\n\n* Security: Fixed command injection vulnerability CVE-2021-41116\n","status":"published","published":"2022-05-10T09:13:38Z","modified":"2026-02-04T04:09:37.359269Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11617-1","title":"php-composer2-2.1.12-1.1 on GA media","description":"These are all security issues fixed in the php-composer2-2.1.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:13:14.667661Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11874-1","title":"php-composer-1.10.25-1.1 on GA media","description":"These are all security issues fixed in the php-composer-1.10.25-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:35.831397Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}