{"action":"Upgrade composer/composer to 1.10.22 or later.","affected":[{"fixed":"1.10.22","introduced":"0"},{"fixed":"2.0.13","introduced":"2.0.0-alpha1"}],"component":"composer/composer","cve_ids":["CVE-2021-29472"],"ecosystem":"Packagist","epss":0.04752,"exploited":false,"fixed_versions":["1.10.22","2.0.13"],"ghsa_id":"GHSA-h5h8-pc6h-jvvx","id":"tcs_01M5KF3BX131ESK6K1CCBKABRV","modified_at":"2026-07-08T06:29:06.943804097Z","published_at":"2021-04-29T21:52:04Z","references":["https://osv.dev/vulnerability/GHSA-h5h8-pc6h-jvvx","https://github.com/composer/composer/security/advisories/GHSA-h5h8-pc6h-jvvx","https://nvd.nist.gov/vuln/detail/CVE-2021-29472","https://blog.sonarsource.com/php-supply-chain-attack-on-composer","https://getcomposer.org","https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2021-29472.yaml","https://github.com/composer/composer","https://lists.debian.org/debian-lts-announce/2021/05/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAQUAMGO4Q4BLNZ2OH4CXQD7UK4IO2GE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KN3DMFH42BJW45VT6FYF2RXKC26D6VC2","https://www.debian.org/security/2021/dsa-4907"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-h5h8-pc6h-jvvx","url":"https://osv.dev/vulnerability/GHSA-h5h8-pc6h-jvvx"}],"summary":"Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial"}