CVE-2021-41116: composer Command Injection
Vulnerability summary
CVE-2021-41116 is a critical (CVSS 9.8) Command Injection vulnerability in composer. EPSS estimates a 2.83% chance of exploitation in the next 30 days, higher than 86.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 05-10-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.83%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
-0.08 pp
From 2.90% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Opensuse2 products
- php-composer2&distro=openSUSE Tumbleweed< 2.1.12-1.1
- php-composer&distro=openSUSE Tumbleweed< 1.10.25-1.1
Composer1 product
- composer< 1.10.23 | ≥ 2.0, < 2.1.9
Getcomposer1 product
- composer< 1.10.23 | ≥ 2.0.0, < 2.1.9
Tenable1 product
- tenable.sc< 5.21.0
Ubuntu1 product
- composerAll versions (No fix recorded)
5 vendors · 6 products
References
6 links- github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcfX Refsource CONFIRMREPORTThird Party Advisory
- github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aaX Refsource MISCREPORTPatchThird Party Advisory