Critical severity · published Oct 5, 2021
CVE-2021-41116
Composer is an open source dependency manager for the PHP language
9.8
CVSS
2.8%
EPSS
No
On KEV
Description
Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Composer · Getcomposer
before 1.10.23; 2.0.0 before 2.1.9 · source: NVD
TE
Tenable.sc · Tenable
before 5.21.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41116
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41116
Patch
https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa
Third Party Advisory
https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf
www.sonarsource.com
https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
More from Composer
8.8
CVE-2026-40261
Composer has Command Injection via Malicious Perforce Reference
8.8
CVE-2023-43655
Composer is a dependency manager for PHP
8.8
CVE-2015-8371
Composer before 2016-02-10 allows cache poisoning from other projects built on the same host
8.8
CVE-2022-24828
Composer is a dependency manager for the PHP programming language
8.8
CVE-2021-29472
Composer is a dependency manager for PHP