CVE-2021-29472

🗓️ 27 Apr 2021 20:30:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 293 Views

Composer, dependency manager for PHP, has a remote code execution vulnerability in handling Mercurial repository URLs and package source download URLs

Reporter	Title	Published	Views	Family All 46
AlpineLinux	CVE-2021-29472	27 Apr 202120:30	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in Composer	3 May 202623:59	–	astralinux
BDU FSTEC	The vulnerability of the HgDriver component of the PHP Composer dependency manager relates to the implementation or modification of arguments, allowing attackers to access confidential data, compromise its integrity, and cause service failures.	27 Oct 202100:00	–	bdu_fstec
Circl	CVE-2021-29472	3 May 202116:06	–	circl
CNNVD	composer 参数注入漏洞	27 Apr 202100:00	–	cnnvd
CNVD	Composer Parameter Injection Vulnerability	30 Apr 202100:00	–	cnvd
Cvelist	CVE-2021-29472 Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer	27 Apr 202120:30	–	cvelist
Debian	[SECURITY] [DLA 2654-1] composer security update	11 May 202120:50	–	debian
Debian	[SECURITY] [DSA 4907-1] composer security update	29 Apr 202116:50	–	debian
Debian	[SECURITY] [DSA 4907-1] composer security update	29 Apr 202116:50	–	debian

NVD

Vulners

Node

getcomposer composerRange<1.10.22

getcomposer composerRange2.0–2.0.13

Node

debian debian_linuxMatch9.0

debian debian_linuxMatch10.0

Node

fedoraproject fedoraMatch33

fedoraproject fedoraMatch34

[
  {
    "product": "composer",
    "vendor": "composer",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.10.22"
      },
      {
        "status": "affected",
        "version": ">=2.0,<2.0.13"
      }
    ]
  }
]

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2021/05/msg00009.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FAQUAMGO4Q4BLNZ2OH4CXQD7UK4IO2GE/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KN3DMFH42BJW45VT6FYF2RXKC26D6VC2/
debian	www.debian.org/security/2021/dsa-4907
getcomposer	www.getcomposer.org/
github	www.github.com/composer/composer/security/advisories/GHSA-h5h8-pc6h-jvvx
blog	www.blog.sonarsource.com/php-supply-chain-attack-on-composer/

17 Jun 2026 03:47Current

9High risk

Vulners AI Score9

CVSS 26.5

CVSS 3.18.8

EPSS0.0481