Ensure plugins from CWD/vendor do not get loaded when running create-…

…project, fixes #10935

src/Composer/Command/CreateProjectCommand.php

@@ -403,7 +403,15 @@ protected function installRootPackage(IOInterface $io, Config $config, $packageN
             throw new \InvalidArgumentException('Invalid stability provided ('.$stability.'), must be one of: '.implode(', ', array_keys(BasePackage::$stabilities)));
         }
 
-        $composer = Factory::create($io, $config->all(), $disablePlugins);
+        $composerJson = array_merge(
+            // prevent version guessing from happening
+            array('version' => '1.0.0'),
+            $config->all(),
+            // ensure the vendor dir and its plugins does not get loaded if CWD/vendor has plugins in it
+            array('config' => array('vendor-dir' => Platform::getDevNull()))
+        );
+        $factory = new Factory;
+        $composer = $factory->createComposer($io, $composerJson, $disablePlugins, Platform::getDevNull(), true, $disableScripts);
         $config = $composer->getConfig();
         $rm = $composer->getRepositoryManager();