Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

symfony/process

Executes commands in sub-processes

Composer latest 8.1.7 MIT

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

8.1.7

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

High

2 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

2
GHSA-qq5c-677p-737q high

Symfony vulnerable to command execution hijack on Windows with Process class

Affected range

ECOSYSTEM: introduced 0; fixed 5.4.46ECOSYSTEM: introduced 6.0.0; fixed 6.4.14ECOSYSTEM: introduced 7.0.0; fixed 7.1.7>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.46|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.14|>=7.0.0,<7.1.0|>=7.1.0,<7.1.7

Fixed versions: 5.4.46, 6.4.14, 7.1.7

CVE-2024-51736 Source ↗Source ↗
GHSA-r39x-jcww-82v6 moderate

Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows

Affected range

ECOSYSTEM: introduced 0; fixed 5.4.51ECOSYSTEM: introduced 6.4; fixed 6.4.33ECOSYSTEM: introduced 7.3; fixed 7.3.11ECOSYSTEM: introduced 7.4; fixed 7.4.5ECOSYSTEM: introduced 8.0; fixed 8.0.5

Fixed versions: 5.4.51, 6.4.33, 7.3.11, 7.4.5, 8.0.5

CVE-2026-24739 Source ↗Source ↗