Composer -- Multiple command injections via malicious git/hg branch names

Composer project reports:

The status, reinstall and remove commands with packages
installed from source via git containing specially crafted
branch names in the repository can be used to execute
code.

The composer install command running inside a git/hg
repository which has specially crafted branch names can
lead to command injection. So this requires cloning
untrusted repositories.