Improper escaping of command arguments on Windows leading to command injection
Package
Affected versions
<1.10.23 || >=2.0,<2.1.9
Patched versions
1.10.23, 2.1.9
Description
Credits
-
paul-gerste-sonarsource Analyst
paul-gerste-sonarsource
Analyst
Impact
Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected.
Patches
1.10.23 and 2.1.9 fix the issue
Workarounds
None