Improper escaping of command arguments on Windows leading to command injection

概要

参考情報

• composer/composer security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2021-41116 · ADVISORY
• composer/composer commit ca5e2f8 · WEB
• FriendsOfPHP/security-advisories · WEB
• composer/composer · PACKAGE
• sonarsource.com/blog/securing-developer-tools-package-managers · WEB
• tenable.com/security/tns-2022-09 · WEB
• sonarsource.com/blog/securing-developer-tools-package-managers

composer/composer のその他の脆弱性

• CVE-2026-59944中 6.1Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised depende…
• CVE-2026-84361高 7.7Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Compos…
• CVE-2026-45793高 7.5Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validate…
• CVE-2026-59948高 7.0Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repositor…
• CVE-2026-59947中 4.7Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could …