This allows a local privilege escalation attack with arbitrary code execution. This is a security vulnerability. You have to remember that composer is run by a number of different system users, and often as root. The paths composer is scanning are not being checked for permissions, writableness by non-root users, etc. The fix is straightforward, version check before parse or get rid of the parse call (its not even needed here)