Composer · Composer · CVE-2024-35241
**Name of the Vulnerable Software and Affected Versions**
Composer versions prior to 2.2.24 and 2.7.7
**Description**
The issue is related to the incorrect neutralization of special elements in the `getUnpushedChanges()` function of the Composer dependency manager for PHP. This can allow a remote attacker to execute arbitrary commands using the `status`, `reinstall`, and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository.
**Recommendations**
For versions prior to 2.2.24, update to version 2.2.24 for the 2.2 LTS branch.
For versions prior to 2.7.7, update to version 2.7.7 for the mainline branch.
As a temporary workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.