CVE-2026-84361

Received Received - Intake

Remote Code Execution in Composer via Malicious Perforce Source

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84361

Affected Vendors & Products

Vendor	Product	Version / Range
composer	composer	to 2.2.30 (inc)
composer	composer	2.10.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects Composer, a PHP dependency manager. A malicious package could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When Composer installs the package using --prefer-source, it passes the address to the Perforce p4 client without validation. This allows p4 to execute local commands with the user or CI account's privileges.

Detection Guidance

Check Composer version with 'composer --version'. If using versions before 2.2.30 or 2.10.3, the system is vulnerable. Inspect composer.lock for packages with source.type set to 'perforce' or source.url containing 'rsh:' or 'jsh:'.

Impact Analysis

If you use Composer versions before 2.2.30 or 2.10.3 and install a malicious package from a custom repository or untrusted composer.lock file, an attacker could run arbitrary commands on your system with your user or CI account privileges. This could lead to data theft, system compromise, or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's security rules if personal or health data is compromised. Organizations must ensure they use patched Composer versions to maintain compliance.

Mitigation Strategies

Upgrade Composer to version 2.2.30 or later. Remove any untrusted packages from composer.lock. Avoid using --prefer-source flag with untrusted repositories. Verify no perforce source configurations exist in composer.json or lock files.

Hi! I’m here to help you understand CVE-2026-84361. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70