Skip to content
fr Sign in
7.7 High

CVE-2026-84361 Composer is a dependency Manager for the PHP language

Description

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

Affected products and versions

Product Affected versions Fixed in
composer 2.3 2.3.0 → < 2.10.3 2.10.3
composer 1.0 1.0 → < 2.2.30 2.2.30

References

Timeline

  1. Published
  2. Last modified

Other CVEs of composer

The 16 CVEs of composer →
CVE-2026-59944 Composer is a dependency Manager for the PHP language 6.1 Medium CVE-2026-45793 Composer is a dependency Manager for the PHP language 7.5 High CVE-2026-59947 Composer is a dependency Manager for the PHP language 4.7 Medium CVE-2026-59948 Composer is a dependency Manager for the PHP language 7.0 High
Track this CVE