Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-84361

Опубликовано: 01 сент. 2026
Источник: redhat
CVSS3: 7.3
EPSS Низкий

Описание

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

A flaw was found in Composer. A malicious dependency package from a custom Composer repository or an untrusted composer.lock file could exploit a vulnerability in how Composer handles Perforce source URLs. By setting source.type to perforce and source.url to an rsh: or jsh: P4PORT value, an attacker could cause the Perforce p4 client to execute arbitrary local commands. This could lead to arbitrary code execution with the privileges of the user or continuous integration (CI) account running Composer.

Меры по смягчению последствий

To mitigate this issue, avoid installing the Perforce p4 client on systems where Composer is used, unless explicitly required. Additionally, ensure that Composer only processes dependencies from trusted repositories and composer.lock files to prevent the introduction of malicious source.url values.

Дополнительная информация

Статус:

Important
Дефект:
CWE-78
https://bugzilla.redhat.com/show_bug.cgi?id=2527051composer: Composer: Arbitrary code execution via malicious Perforce source URL

EPSS

Процентиль: 34%
0.00409
Низкий

7.3 High

CVSS3

Связанные уязвимости

ubuntu
14 дней назад

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

nvd
15 дней назад

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

debian
15 дней назад

Composer is a dependency Manager for the PHP language. From 1.0 until ...

suse-cvrf
10 дней назад

Security update for php-composer2

suse-cvrf
8 дней назад

Security update for php-composer2

EPSS

Процентиль: 34%
0.00409
Низкий

7.3 High

CVSS3