Seldaek

The Symfony Process component did not properly handle certain characters, specifically `=`, when escaping arguments on Windows systems. When running PHP from an MSYS2-based environment like Git Bash and spawning native Windows executables, the MSYS2 argument/path conversion can incorrectly handle unquoted arguments containing these characters. This can lead to spawned processes receiving corrupted or truncated arguments, deviating from the intended behavior of Symfony. If an application utilizes Symfony Process to invoke file-management commands (e.g., `rmdir`, `del`) with a path argument containing `=`, the MSYS2 conversion layer may alter the argument during runtime. This can result in operations being performed on an unintended path, potentially including the deletion of files or directories. The issue is particularly relevant when untrusted input influences process arguments, such as repository paths, extracted archive paths, temporary directories, or user-controlled configuration.

Composer, a dependency manager for PHP, may allow attackers who control remote sources from which Composer downloads to inject ANSI control characters into the terminal output of various Composer commands. This can result in distorted output and potentially cause a denial-of-service condition for the terminal application. There is no known exploit for this issue, but it is considered potentially abusable.

The issue is related to the incorrect neutralization of special elements in the `getUnpushedChanges()` function of the Composer dependency manager for PHP. This can allow a remote attacker to execute arbitrary commands using the `status`, `reinstall`, and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository.

The issue is related to the `VcsDriver::getFileContent` method in Composer, a dependency manager for PHP. If a user can control the `$file` or `$identifier` argument, it may lead to a code injection vulnerability. This vulnerability can be exploited on platforms like packagist.org, where the `readme` field in composer.json can be used to inject parameters into hg/Mercurial via the `$file` argument or into git via the `$identifier` argument. To the best of our knowledge, this vulnerability was not actively exploited. The vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.