diff --git a/changelogs/fragments/10525-composer-cmd-list.yml b/changelogs/fragments/10525-composer-cmd-list.yml
new file mode 100644
index 0000000000..a2aebc8a6d
--- /dev/null
+++ b/changelogs/fragments/10525-composer-cmd-list.yml
@@ -0,0 +1,2 @@
+minor_changes:
+  - composer - using safer mechanism to run external command (https://github.com/ansible-collections/community.general/pull/10525).
diff --git a/plugins/modules/composer.py b/plugins/modules/composer.py
index 735b4d2d36..d932a5a060 100644
--- a/plugins/modules/composer.py
+++ b/plugins/modules/composer.py
@@ -188,7 +188,7 @@ def composer_command(module, command, arguments="", options=None):
     else:
         composer_path = module.params['composer_executable']
 
-    cmd = "%s %s %s %s %s %s" % (php_path, composer_path, "global" if global_command else "", command, " ".join(options), arguments)
+    cmd = [php_path, composer_path, "global" if global_command else "", command] + options + [arguments]
     return module.run_command(cmd)