What’s Vulnerable › Vulnerabilities

CVE-2021-41116: Command injection in composer on Windows

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-05 · updated 2026-06-17
• Weakness: CWE-77

Description

Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.

Affected products

• composer: before 1.10.23; from 2.0.0 before 2.1.9 — fixed in 1.10.23, 2.1.9
• Tenable.sc: before 5.21.0 — fixed in 5.21.0
• Packagist Composer/Composer: before 1.10.23; from 2.0.0-alpha1 before 2.1.9; 1.0.0, 1.0.0-alpha1, 1.0.0-alpha10, 1.0.0-alpha11, 1.0.0-alpha2, 1.0.0-alpha3 (+115) — fixed in 1.10.23, 2.1.9

How to fix

Upgrade to a fixed version: composer 1.10.23, 2.1.9; Tenable.sc 5.21.0; Packagist Composer/Composer 1.10.23, 2.1.9. Check the vendor advisory for mitigations.

References

• https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa
• https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf
• https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
• https://github.com/composer/composer/commit/ca5e2f8d505fd3bfac6f7c85b82f2740becbc0aa
• https://github.com/composer/composer/security/advisories/GHSA-frqg-7g38-6gcf
• https://www.sonarsource.com/blog/securing-developer-tools-package-managers/

Get alerted when CVE-2021-41116 or the next vulnerability affects your stack