CVE-2026-84361: Composer arbitrary command execution via malicious Perforce source URL

CVE-2026-84361 · Severity: high · CVSS 4 · Published 2026-09-01

Composer, a PHP package dependency manager, fails to validate Perforce version control URLs in malicious packages. When the p4 Perforce client is installed on a developer machine or CI system, an attacker can craft a package with a specially crafted Perforce URL that causes Composer to execute arbitrary commands during install or update operations. This affects teams using private package repositories or untrusted lock files, potentially compromising developer workstations and CI/CD pipelines.

Technologies: Composer (Packagist), composer/composer (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-84361 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84361 being exploited in the wild.
How severe is CVE-2026-84361?
High severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
Composer (Packagist) >=1.0,<2.2.30; >=2.3.0,<2.10.3; composer/composer (Packagist) ECOSYSTEM:introduced=2.3.0,fixed=2.10.3.
Is there a fix for CVE-2026-84361?
Yes. composer/composer (Packagist): upgrade to 2.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84361 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84361?
Check whether you run Composer (Packagist) or composer/composer (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • composer/composer (Packagist): upgrade to 2.10.3 or later
    composer require composer/composer:^2.10.3

Technical details

The vulnerability is an OS command injection (CWE-78) in Composer's handling of Perforce repository URLs. Composer passes the source URL from package metadata directly to the p4 CLI client without validation. The p4 client interprets certain URL formats (e.g., local command prefixes) as instructions to execute local processes rather than connect to a remote server. Attack requires: (1) p4 CLI installed and in PATH, (2) package installation from source (no dist artifact or --prefer-source flag), and (3) attacker control over package metadata in a non-Packagist repository or a compromised lock file. The attacker gains code execution with the privileges of the user/CI account running Composer. Fixed in Composer 2.10.3 and 2.2.30 by validating that Perforce addresses are legitimate network endpoints (host:port with optional tcp/ssl transport).

Affected products

  • Composer Composer >=1.0,<2.2.30; >=2.3.0,<2.10.3

Identifiers

  • CVE-2026-84361
  • GHSA-rvx4-ffvw-m9q3

Timeline

  • 2026-09-08: disclosed: Published to GitHub Advisory Database
  • 2026-08-27: advisory: GitHub Security Advisory review published
  • 2026-09-08: patched: Fixed in Composer 2.10.3 and 2.2.30

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.