Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Composer allows malicious Perforce repository to run arbitrary commands
GHSA-wg36-wvj6-r67p
CVE-2026-40176
Summary
A vulnerability in Composer allows a malicious Perforce repository to execute arbitrary commands on your system if you run Composer on a project with a malicious composer.json file. This can happen if you run Composer on a project from an untrusted source. To protect yourself, inspect your project's composer.json file carefully before running Composer, or only use trusted projects.
What to do
- Update composer composer to version 2.9.6.
- Update composer composer to version 2.2.27.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| composer | composer | > 2.3.0 , <= 2.9.6 | 2.9.6 |
| composer | composer | > 2.0.0 , <= 2.2.27 | 2.2.27 |
Original title
Composer has a command injection via malicious perforce repository
Original description
### Impact
The `Perforce::generateP4Command()` method constructed shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker controlling a repository configuration in a malicious composer.json declaring a Perforce VCS repository could inject arbitrary commands through these values, leading to command execution in the context of the user running Composer. Composer would execute these injected commands even if Perforce is not installed.
VCS repositories are only loaded from the root composer.json file located in the directory you execute Composer commands in and from the composer config directory (e.g. `~/.config/composer/composer.json`). So this vulnerability cannot be exploited through composer.json files of packages installed as dependencies.
You are at risk of command execution if you run Composer commands on untrusted projects with attacker supplied composer.json files, regardless of whether you or any of your dependencies use Perforce.
### Patches
Fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline)
### Workarounds
- Carefully inspect composer.json files before running Composer on them. Verify that Perforce-related fields contain valid values.
- Only run Composer commands on projects from trusted sources.
The `Perforce::generateP4Command()` method constructed shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker controlling a repository configuration in a malicious composer.json declaring a Perforce VCS repository could inject arbitrary commands through these values, leading to command execution in the context of the user running Composer. Composer would execute these injected commands even if Perforce is not installed.
VCS repositories are only loaded from the root composer.json file located in the directory you execute Composer commands in and from the composer config directory (e.g. `~/.config/composer/composer.json`). So this vulnerability cannot be exploited through composer.json files of packages installed as dependencies.
You are at risk of command execution if you run Composer commands on untrusted projects with attacker supplied composer.json files, regardless of whether you or any of your dependencies use Perforce.
### Patches
Fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline)
### Workarounds
- Carefully inspect composer.json files before running Composer on them. Verify that Perforce-related fields contain valid values.
- Only run Composer commands on projects from trusted sources.
ghsa CVSS3.1
7.8
Vulnerability type
CWE-78
OS Command Injection
Published: 14 Apr 2026 · Updated: 14 Apr 2026 · First seen: 14 Apr 2026