Executive brief
Composer, a PHP package dependency manager, fails to validate Perforce version control URLs in malicious packages. When the p4 Perforce client is installed on a developer machine or CI system, an attacker can craft a package with a specially crafted Perforce URL that causes Composer to execute arbitrary commands during install or update operations. This affects teams using private package repositories or untrusted lock files, potentially compromising developer workstations and CI/CD pipelines.
Technical details
The vulnerability is an OS command injection (CWE-78) in Composer's handling of Perforce repository URLs. Composer passes the source URL from package metadata directly to the p4 CLI client without validation. The p4 client interprets certain URL formats (e.g., local command prefixes) as instructions to execute local processes rather than connect to a remote server. Attack requires: (1) p4 CLI installed and in PATH, (2) package installation from source (no dist artifact or --prefer-source flag), and (3) attacker control over package metadata in a non-Packagist repository or a compromised lock file. The attacker gains code execution with the privileges of the user/CI account running Composer. Fixed in Composer 2.10.3 and 2.2.30 by validating that Perforce addresses are legitimate network endpoints (host:port with optional tcp/ssl transport).
Affected products
- Composer Composer >=1.0,<2.2.30; >=2.3.0,<2.10.3
Timeline
- 2026-09-08: disclosed: Published to GitHub Advisory Database
- 2026-08-27: advisory: GitHub Security Advisory review published
- 2026-09-08: patched: Fixed in Composer 2.10.3 and 2.2.30