Vulnerability · Published Sep 1, 2026 · Assigned by GitHub_M

CVE-2026-84361Composer: Perforce source URL permits P4PORT `rsh:` command execution

High 7.7

In plain English

A high-severity OS command injection in composer from composer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	composer	2.10.3-r0	ALPINE-CVE-2026-84361
Debian:12	composer	no fix listed	DEBIAN-CVE-2026-84361
Debian:13	composer	no fix listed	DEBIAN-CVE-2026-84361
Debian:14	composer	2.10.3-1	DEBIAN-CVE-2026-84361
Packagist	composer/composer	2.2.30	GHSA-rvx4-ffvw-m9q3
Packagist	composer/composer	2.10.3	GHSA-rvx4-ffvw-m9q3
Ubuntu:26.04:LTS	composer	no fix listed	UBUNTU-CVE-2026-84361
Ubuntu:26.10	composer	no fix listed	UBUNTU-CVE-2026-84361

Affected products (as reported)

Vendor	Product	Versions
composer	composer	>= 1.0, < 2.2.30>= 2.3.0, < 2.10.3

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3 x_refsource_CONFIRM
https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220 x_refsource_MISC
https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af x_refsource_MISC
https://github.com/composer/composer/releases/tag/2.10.3 x_refsource_MISC
https://github.com/composer/composer/releases/tag/2.2.30 x_refsource_MISC