Skip to content
OpenAdvisories
High USN-5220-1 1 CVE

composer vulnerability

Published Jul 8, 2022 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Composer did not properly sanitize URLs for
Mercurial repositories in the root composer.json and package source
download URLs. A remote attacker could possibly use this issue to execute
arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS composer 1.0.0~beta2-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS composer 1.6.3-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS composer 1.10.1-1ubuntu0.1~esm1

Vulnerabilities 1

  • High 8.8
    CVE-2021-29472

    Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer

    Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is inst…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist

References

  • report
    https://ubuntu.com/security/CVE-2021-29472