Composer 2.10.3 fixes two more CVEs, including a Perforce command injection
Versions 2.10.2 and 2.10.3 fixed a run of CVEs, from path traversal through package bin paths to command injection through malicious Perforce URLs.
What to do
Run composer self-update to get 2.10.3.
Versions 2.10.2 (July 1) and 2.10.3 (August 27) fixed a run of CVEs: path traversal through package bin paths (including via symlinks), file writes outside vendor/, tokens leaking into verbose logs, and command injection through malicious Perforce URLs.