OS Command Injection in composer - #VU146003
Published: August 27, 2026
Vulnerability identifier: #VU146003
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to command injection in the Perforce source URL handling in Composer when processing a malicious package\'s Perforce source address during install or update. A remote attacker can provide a specially crafted package source URL to execute arbitrary commands.
The issue is exploitable only if the Perforce p4 client is installed and available on the PATH, and the package is installed from source. User interaction is required to run composer install or composer update.
Affected software
composer
Remediation
Install security update from vendor's website.
composer - addressed in versions 2.2.30, 2.10.3