OS Command Injection in composer - CVE-2026-40261

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125894

OS Command Injection in composer - CVE-2026-40261

Published: April 14, 2026


Vulnerability identifier: #VU125894
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40261
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to command injection in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods when processing package metadata containing a crafted Perforce source reference or source url. A remote attacker can supply a malicious package through a Composer repository to execute arbitrary commands.

The issue is exploitable when installing or updating dependencies from source, including with --prefer-source and by default for dev prefixed versions. User interaction is required to install or update the dependency.


Affected software

composer
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
Fedora
Web and Scripting Module
openSUSE Leap
Anolis OS
php-composer2
composer
composer-doc

How to mitigate CVE-2026-40261

Install security update from vendor's website.

composer - addressed in versions 2.2.27, 2.9.6
php-composer2 - addressed in versions 2.6.4-150600.3.9.1, 2.6.4-150600.3.12.1
composer - update to 2.9.7-1
composer-doc - update to 2.9.7-1
composer - addressed in versions 2.9.7-1.el9, 2.9.7-1.el10_1, 2.9.7-1.el10_2, 2.9.7-1.el10_3, 2.9.7-1.fc42, 2.9.7-1.fc43, 2.9.7-1.fc44

External References

Related Security Bulletins