CVE Feed

    Dashboard / CVE / CVE-2021-41116

    CVE-2021-41116

    Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.

    Published:Oct 5, 2021
    Last Modified:Nov 21, 2024
    EPS:Oct 5, 2021
    EPSS Score:0.0072
    CVSS Score:8.2

    Affected Products

    Vendor
    Getcomposer
    Product
    Composer
    Vendor
    Tenable
    Product
    Tenable.sc

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-84361 (CVSS 7.7) — Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependenc…
    CVE-2026-45793 (CVSS 7.5) — Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO…
    CVE-2026-59947 (CVSS 4.7) — Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -…
    CVE-2026-59948 (CVSS 7) — Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted packa…
    CVE-2026-59946 (CVSS 6.1) — Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entr…
    CVE-2026-40261 (CVSS 8.8) — Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command …
    CVE-2026-40176 (CVSS 7.8) — Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command …
    CVE-2025-67746 (CVSS 1.3) — Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers c…
    CVE-2024-35242 (CVSS 8.8) — Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer …
    CVE-2024-35241 (CVSS 8.8) — Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High