CVE-2026-84361
Published:September 01, 2026
Updated:September 02, 2026
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
Affected Packages
https://github.com/composer/composer.git (GITHUB):
Affected version(s) >=1.0.0 <2.2.30Fix Suggestion:
Update to version 2.2.30https://github.com/composer/composer.git (GITHUB):
Affected version(s) >=2.3.0 <2.10.3Fix Suggestion:
Update to version 2.10.3composer/composer (PHP):
Affected version(s) >=2.3.0 <2.10.3Fix Suggestion:
Update to version 2.10.3composer/composer (PHP):
Affected version(s) >=1.0.0 <2.2.30Fix Suggestion:
Update to version 2.2.30Related Resources (5)
Do you need more information?
Contact UsCVSS v4
Base Score:
7.7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')