SB20260827147 - Multiple vulnerabilities in composer
Published: August 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) OS Command Injection (CVE-ID: N/A)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to command injection in the Perforce source URL handling in Composer when processing a malicious package\'s Perforce source address during install or update. A remote attacker can provide a specially crafted package source URL to execute arbitrary commands.
The issue is exploitable only if the Perforce p4 client is installed and available on the PATH, and the package is installed from source. User interaction is required to run composer install or composer update.
2) Link following (CVE-ID: CVE-2026-59944)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal and improper link resolution in package binary handling when installing a malicious or compromised dependency package. A remote attacker can supply a specially crafted package or manipulated installed dependency metadata to cause Composer to change permissions on a file outside the package directory and expose its contents to disclose sensitive information.
User interaction is required to install or update dependencies. The issue can be triggered through a symbolic link that resolves outside the package directory or through crafted vendor/composer/installed.json metadata when binaries are regenerated from an existing vendor directory.
Remediation
Install update from vendor's website.