Command injection in composer on Windows
Priority MEDIUM 47CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
Why it matters now
EPSS 0.02825 86th percentileScored 2026-11-07
Fix Fixed composer (composer): 1.10.23, 2.1.9composer/composer (Packagist): 1.10.23, 2.1.9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| composer | composer | before 1.10.23; 2.0 to before 2.1.9 | 1.10.23, 2.1.9 | Patch available | CNA |
| — | composer/composer (Packagist) | before 1.10.23 | 1.10.23 | Patch available | GHSA-frqg-7g38-6gcf |
| — | composer/composer (Packagist) | 2.0.0-alpha1 to before 2.1.9 | 2.1.9 | Patch available | GHSA-frqg-7g38-6gcf |
- composer Vendorcomposer Affected before 1.10.23; 2.0 to before 2.1.9 Fixed in 1.10.23, 2.1.9 Patch available CNA
- composer/composer (Packagist) Vendor— Affected before 1.10.23 Fixed in 1.10.23 Patch available GHSA-frqg-7g38-6gcf
- composer/composer (Packagist) Vendor— Affected 2.0.0-alpha1 to before 2.1.9 Fixed in 2.1.9 Patch available GHSA-frqg-7g38-6gcf
Remediation
- Fix · CNA composer (composer) Fixed in 1.10.23, 2.1.9
- Fix · GHSA-frqg-7g38-6gcf composer/composer (Packagist) Fixed in 1.10.23 Advisory →
- Fix · GHSA-frqg-7g38-6gcf composer/composer (Packagist) Fixed in 2.1.9 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41116
- 2026-10-03 Alias added: GHSA-frqg-7g38-6gcf
References
Advisory 2
Other 5
- https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
- https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-41116.yaml
- https://github.com/composer/composer
- https://www.sonarsource.com/blog/securing-developer-tools-package-managers
- https://www.tenable.com/security/tns-2022-09
More Composer vulnerabilities
- TI-2015-06892 Composer before 2016-02-10 allows cache poisoning from other projects built on the same… CVSS 3.1HIGH 8.8
- TI-2021-10185 Code injection in composer CVSS 3.1HIGH 8.8
- TI-2022-08641 Missing input validation can lead to command execution in composer CVSS 3.1HIGH 8.8
- TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
- TI-2023-23380 Remote Code Execution via web-accessible composer.phar CVSS 3.1HIGH 8.8
- TI-2024-16338 Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer CVSS 3.1HIGH 8.8
Sources
- CVE-2021-41116 · CVE Program
- CVE-2021-41116 · NVD
- FIRST EPSS
- GHSA-frqg-7g38-6gcf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences