Skip to content
OpenAdvisories
High DSA-4907-1 1 CVE

composer - security update

Published Apr 29, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 composer 1.8.4-1+deb10u1

Vulnerabilities 1

  • High 8.8
    CVE-2021-29472

    Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer

    Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is inst…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist