composer

symfony/process

Security advisories for symfony/process, newest first. 2 known, all fixed. If you’re on 8.0.5 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.1.10

Advisories

2 · 0 unfixed

Last advisory

28 Jan 2026

Safe from

8.0.5

2 advisories · newest first

MODERATE6.3 28 Jan 2026

Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows

GHSA-r39x-jcww-82v6 · CVE-2026-24739

Affected

< 5.4.51 ≥ 6.4, < 6.4.33 ≥ 7.3, < 7.3.11

and 2 more

≥ 7.4, < 7.4.5 ≥ 8.0, < 8.0.5

Fixed in

5.4.51 6.4.33 7.3.11

and 2 more

7.4.5 8.0.5

Published

28 Jan 2026

HIGH0.0 5 Nov 2024

CVE-2024-51736: Command execution hijack on Windows with Process class

PKSA-wws7-mr54-jsny · CVE-2024-51736

Affected

≥ 2.0.0, < 5.4.46 ≥ 6.0.0, < 6.4.14 ≥ 7.0.0, < 7.1.7

Fixed in

5.4.46 6.4.14 7.1.7

Published

5 Nov 2024

/advisories/composer/symfony/process/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

symfony/cache3 advisories symfony/dom-crawler1 advisory symfony/error-handler1 advisory symfony/expression-language1 advisory symfony/http-client2 advisories symfony/http-foundation15 advisories symfony/http-kernel8 advisories symfony/mailer1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →