Code injection in composer
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-88.
Summary
Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins. The main impact is to services passing user input to Composer, including Packagist.org and Private Packagist. This allowed users to trigger remote code execution. The vulnerability has been patched on Packagist.org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs, to the best of our knowledge, was not abused by anyone. Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately. Versions 1.10.22 and 2.0.13 include patches for this issue.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| composer | composer | before 1.10.22; 2.0 to before 2.0.13 | 1.10.22, 2.0.13 | Patch available | CNA |
| — | composer/composer (Packagist) | before 1.10.22 | 1.10.22 | Patch available | GHSA-h5h8-pc6h-jvvx |
| — | composer/composer (Packagist) | 2.0.0-alpha1 to before 2.0.13 | 2.0.13 | Patch available | GHSA-h5h8-pc6h-jvvx |
- composer Vendorcomposer Affected before 1.10.22; 2.0 to before 2.0.13 Fixed in 1.10.22, 2.0.13 Patch available CNA
- composer/composer (Packagist) Vendor— Affected before 1.10.22 Fixed in 1.10.22 Patch available GHSA-h5h8-pc6h-jvvx
- composer/composer (Packagist) Vendor— Affected 2.0.0-alpha1 to before 2.0.13 Fixed in 2.0.13 Patch available GHSA-h5h8-pc6h-jvvx
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:* | before 1.10.22; 2.0 to before 2.0.13 | Vulnerable | composer |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:* Versions before 1.10.22; 2.0 to before 2.0.13 Vulnerable ·composer
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA composer (composer) Fixed in 1.10.22, 2.0.13
- Fix · GHSA-h5h8-pc6h-jvvx composer/composer (Packagist) Fixed in 1.10.22 Advisory →
- Fix · GHSA-h5h8-pc6h-jvvx composer/composer (Packagist) Fixed in 2.0.13 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29472
- 2026-10-03 Alias added: GHSA-h5h8-pc6h-jvvx
References
Advisory 7
Other 6
- https://blog.sonarsource.com/php-supply-chain-attack-on-composer
- https://getcomposer.org
- https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-29472.yaml
- https://github.com/composer/composer
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FAQUAMGO4Q4BLNZ2OH4CXQD7UK4IO2GE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KN3DMFH42BJW45VT6FYF2RXKC26D6VC2
More Composer vulnerabilities
- TI-2015-06892 Composer before 2016-02-10 allows cache poisoning from other projects built on the same… CVSS 3.1HIGH 8.8
- TI-2021-17955 Command injection in composer on Windows CVSS 3.1CRITICAL 9.8
- TI-2022-08641 Missing input validation can lead to command execution in composer CVSS 3.1HIGH 8.8
- TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
- TI-2023-23380 Remote Code Execution via web-accessible composer.phar CVSS 3.1HIGH 8.8
- TI-2024-16338 Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer CVSS 3.1HIGH 8.8
Sources
- CVE-2021-29472 · CVE Program
- CVE-2021-29472 · NVD
- FIRST EPSS
- GHSA-h5h8-pc6h-jvvx · GitHub Advisory Database · CC BY 4.0
- CVE-2021-29472 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences