CVE-2021-41116: Command injection in composer on Windows
Impact Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected.
Patches 1.10.23 and 2.1.9 fix the issue
Workarounds None
Other sources
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
— MITRE
Improper escaping of command arguments on Windows leading to command injection
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/composer/composerto a version that resolves this vulnerability.Fixed in 2.1.9 - Upgrade
Upgrade
composer/composer/composerto a version that resolves this vulnerability.Fixed in 1.10.23 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.10.23 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.1.9
Event History
Frequently Asked Questions
What is CVE-2021-41116?
CVE-2021-41116 is a vulnerability in Composer, an open source dependency manager for the PHP language, that allows for command injection on Windows systems.
Who is affected by CVE-2021-41116?
Windows users running Composer to install untrusted dependencies are affected by CVE-2021-41116.
How severe is CVE-2021-41116?
CVE-2021-41116 has a severity rating of 9.8 (Critical).
How can I fix CVE-2021-41116?
To fix CVE-2021-41116, affected users should upgrade to a version of Composer that has the issue resolved (2.1.9 or later for versions 2.x, or 1.10.24 or later for versions 1.x).
Where can I find more information about CVE-2021-41116?
More information about CVE-2021-41116 can be found in the following references: [GitHub Security Advisory](https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf), [GitHub Commit](https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa), and [Tenable Security Advisory](https://www.tenable.com/security/tns-2022-09).