GHSA-frqg-7g38-6gcf

Improper escaping of command arguments on Windows leading to command injection

Source: GitHub Advisory Database (reviewed) High CVE-2021-41116

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	composer/composer	< 1.10.23	1.10.23
Packagist	composer/composer	>= 2.0.0-alpha1, < 2.1.9	2.1.9

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected. ### Patches 1.10.23 and 2.1.9 fix the issue ### Workarounds None

References

External links from the advisory. They lead to third-party sites.

https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf web
https://nvd.nist.gov/vuln/detail/CVE-2021-41116 advisory
https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa web
https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-41116.yaml web
https://github.com/composer/composer package
https://www.sonarsource.com/blog/securing-developer-tools-package-managers web
https://www.tenable.com/security/tns-2022-09 web