Skip to content
Fencer Vulns
high 8.8

CVE-2021-29472 json

Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer

published 2021-04-27 5 y ago modified 2026-09-08 2 mo ago also BIT-composer-2021-29472 , EUVD-2021-0829 , GHSA-h5h8-pc6h-jvvx

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.8%
EPSS 4.8% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins. The main impact is to services passing user input to Composer, including Packagist.org and Private Packagist. This allowed users to trigger remote code execution. The vulnerability has been patched on Packagist.org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs, to the best of our knowledge, was not abused by anyone. Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately. Versions 1.10.22 and 2.0.13 include patches for this issue.

Patch / fix

  • packagist composer/composer 1.10.22, 2.0.13
  • bitnami composer 1.10.22, 2.0.13
  • getcomposer composer 1.10.22, 2.0.13
  • composer Debian 14, Debian 13, Debian 12 2.0.9-2

debian advisories DEBIAN-CVE-2021-29472

  • composer Ubuntu Pro 16.04 LTS 1.0.0~beta2-1ubuntu0.1~esm1
  • composer Ubuntu Pro 18.04 LTS 1.6.3-1ubuntu0.1~esm1
  • composer Ubuntu Pro 20.04 LTS 1.10.1-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-29472

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • php-composer openSUSE Tumbleweed 1.10.22-2.2
  • php-composer Package Hub 15 SP3, Package Hub 15 SP2, Package Hub 15 SP1 +2 more 1.10.22-bp153.2.3.1

opensuse advisories openSUSE-SU-2024:11166-1openSUSE-SU-2021:1289-1

  • composer Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 2.0.13-r0

alpine advisories ALPINE-CVE-2021-29472

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • composer Arch Linux 2.0.13-1

arch linux advisories AVG-1885

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-29472 updated cvss 8.1

composer: Specifically crafted URL values allow code to be executed in the HgDriver

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.75% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • blog.sonarsource.com https://blog.sonarsource.com/php-supply-chain-attack-on-composer/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist composer/composer
<1.10.22
>=2.0.0-alpha1, <2.0.13
1.10.22
2.0.13
bitnami composer
<1.10.22
>=2.0.0, <2.0.13
1.10.22
2.0.13

Affected products

  • composer composer

Classification

Weakness
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.