ALPINE-CVE-2021-41116

See a problem?
Please try reporting it to the source first.
Source
https://security.alpinelinux.org/vuln/CVE-2021-41116
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2021-41116
Upstream
Published
2021-10-05T18:15:08Z
Modified
2026-11-03T06:31:47Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.

References

Affected packages

Alpine:v3.14
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.15
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.16
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.17
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.18
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.19
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.20
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.21
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.22
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.23
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"
Alpine:v3.24
composer

Package

Name
composer
Purl
pkg:apk/alpine/composer?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.9-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-41116.json"