Lucene search
GoogleOSV:GHSA-FRQG-7G38-6GCFHistoryOct 05, 2021 - 8:23 p.m.
Improper escaping of command arguments on Windows leading to command injection
2021-10-0520:23:18
Google
osv.dev
10
EPSS
0.003
Percentile
68.2%
Impact
Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected.
Patches
1.10.23 and 2.1.9 fix the issue
Workarounds
None
References
github.com/composer/composer
github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa
github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf
github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-41116.yaml
nvd.nist.gov/vuln/detail/CVE-2021-41116
www.sonarsource.com/blog/securing-developer-tools-package-managers
www.tenable.com/security/tns-2022-09
Related
debiancve
debiancve
CVE-2021-41116
2021-10-05 18:15:08
prion
prion
Command injection
2021-10-05 18:15:00
ubuntucve
ubuntucve
CVE-2021-41116
2021-10-05 00:00:00
alpinelinux
alpinelinux
CVE-2021-41116
2021-10-05 18:15:08
veracode
veracode
Supply Chain Attack
2021-10-05 20:05:41
osv
osv
BIT-composer-2021-41116
2024-03-06 10:51:26
CVE-2021-41116
2021-10-05 18:15:08
nvd
nvd
CVE-2021-41116
2021-10-05 18:15:08
github
github
friendsofphp
friendsofphp
cvelist
cvelist
CVE-2021-41116 Command injection in composer on Windows
2021-10-05 17:40:10
cve
cve
CVE-2021-41116
2021-10-05 18:15:08
nessus
nessus
openSUSE 15 Security Update : php-composer (openSUSE-SU-2022:0132-1)
2022-05-11 00:00:00
Tenable SecurityCenter < 5.21.0 Multiple Vulnerabilities (TNS-2022-09)
2022-05-10 00:00:00
suse
suse
Security update for php-composer (important)
2022-05-10 00:00:00