CVE-2021-41116

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
composer	composer	< 1.10.23; >= 2.0, < 2.1.9

References

https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aaPatch, Third Party Advisory
https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcfThird Party Advisory
https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aaPatch, Third Party Advisory
https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcfThird Party Advisory
https://www.sonarsource.com/blog/securing-developer-tools-package-managers/

Timeline

Published: Oct 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411179.1keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing CVE-2021-411187.5The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and detail CVE-2021-411197.5Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via CVE-2021-41128.8A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elev CVE-2021-411207.5sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after che CVE-2021-411218.8Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there CVE-2021-411224.3Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of dec CVE-2021-411235.3Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics end CVE-2021-411247.5Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use [`HttpAuthMiddleware`](http:CVE-2021-411256.5Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass`CVE-2021-411267.2October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator acc CVE-2021-411277.1Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exist