Page MenuHomePhabricator

CVE-2026-24739: Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows
Closed, ResolvedPublic

Description

21:41:25     - Root composer.json requires symfony/process 6.4.31 (exact version match: 6.4.31 or 6.4.31.0), found symfony/process[v6.4.31] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-rkkf-636k-qjb3") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

https://github.com/advisories/GHSA-r39x-jcww-82v6

Event Timeline

Change #1234511 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@master] Upgrade symfony/*

https://gerrit.wikimedia.org/r/1234511

Reedy renamed this task from symfony/process security issue to CVE-2026-24739: Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows.Jan 28 2026, 9:46 PM
Reedy raised the priority of this task from High to Unbreak Now!.
Reedy updated the task description. (Show Details)

Change #1234516 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@wmf/1.46.0-wmf.12] Upgrade symfony/*

https://gerrit.wikimedia.org/r/1234516

Change #1234517 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@wmf/1.46.0-wmf.13] Upgrade symfony/*

https://gerrit.wikimedia.org/r/1234517

Change #1234516 merged by jenkins-bot:

[mediawiki/vendor@wmf/1.46.0-wmf.12] Upgrade symfony/*

https://gerrit.wikimedia.org/r/1234516

Change #1234517 merged by jenkins-bot:

[mediawiki/vendor@wmf/1.46.0-wmf.13] Upgrade symfony/*

https://gerrit.wikimedia.org/r/1234517

Mentioned in SAL (#wikimedia-operations) [2026-01-28T22:16:17Z] <brennen@deploy2002> Started scap sync-world: Backport for [[gerrit:1234517|Upgrade symfony/* (T415834)]], [[gerrit:1234516|Upgrade symfony/* (T415834)]]

Mentioned in SAL (#wikimedia-operations) [2026-01-28T22:20:24Z] <brennen@deploy2002> brennen, reedy: Backport for [[gerrit:1234517|Upgrade symfony/* (T415834)]], [[gerrit:1234516|Upgrade symfony/* (T415834)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Change #1234511 merged by jenkins-bot:

[mediawiki/vendor@master] Upgrade symfony/*

https://gerrit.wikimedia.org/r/1234511

Mentioned in SAL (#wikimedia-operations) [2026-01-28T22:28:31Z] <brennen@deploy2002> Finished scap sync-world: Backport for [[gerrit:1234517|Upgrade symfony/* (T415834)]], [[gerrit:1234516|Upgrade symfony/* (T415834)]] (duration: 12m 15s)

Zabe assigned this task to Reedy.