OS Command Injection in composer - CVE-2026-40176

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125895

OS Command Injection in composer - CVE-2026-40176

Published: April 14, 2026


Vulnerability identifier: #VU125895
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40176
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to command injection in Perforce::generateP4Command() when processing a malicious Perforce repository definition from a composer.json file. A remote attacker can supply crafted Perforce connection parameters to execute arbitrary commands.

User interaction is required because the victim must run Composer commands on an untrusted project or configuration containing the malicious repository definition.


Affected software

composer
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
Fedora
Web and Scripting Module
openSUSE Leap
Anolis OS
php-composer2
composer
composer-doc

How to mitigate CVE-2026-40176

Install security update from vendor's website.

composer - addressed in versions 2.2.27, 2.9.6
php-composer2 - addressed in versions 2.6.4-150600.3.9.1, 2.6.4-150600.3.12.1
composer - update to 2.9.7-1
composer-doc - update to 2.9.7-1
composer - addressed in versions 2.9.7-1.el9, 2.9.7-1.el10_1, 2.9.7-1.el10_2, 2.9.7-1.el10_3, 2.9.7-1.fc42, 2.9.7-1.fc43, 2.9.7-1.fc44

External References

Related Security Bulletins