Composer has a command injection via malicious git branch name
ImpactThe `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code.Patches2.2.24 for 2.2 LTS or 2.7.7 for mainlineWorkaroundsAvoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.