CVE-2021-41116

Name of the Vulnerable Software and Affected Versions Composer versions prior to 1.10.23 Composer versions prior to 2.1.9

Description The issue affects Windows users running Composer to install untrusted dependencies, subjecting them to command injection. Other operating systems and Windows Subsystem for Linux (WSL) are not affected.

Recommendations For versions prior to 1.10.23, upgrade to version 1.10.23 or later. For versions prior to 2.1.9, upgrade to version 2.1.9 or later. As a temporary workaround, consider avoiding the installation of untrusted dependencies until a patch is applied.