8.8
CVSS V3
Composer has a command injection via malicious git branch name
The status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code.
2.2.24 for 2.2 LTS or 2.7.7 for mainline
Avoid installing dependencies via git by using --prefer-dist or the preferred-install: dist config setting.
