Advisories for Composer/Swiftmailer/Swiftmailer package

Prior to 5.2.1, the sendmail transport (Swift_Transport_SendmailTransport) was vulnerable to an arbitrary shell execution if the "From" header came from a non-trusted source and no "Return-Path" is configured. This has been fixed in 5.2.1. If you are using sendmail as a transport, you are encouraged to upgrade as soon as possible.

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a crafted e-mail address.

Sendmail transport arbitrary shell execution.