A AegiFlow
HIGHCVSS 7.7EPSS 0.4%

CVE-2026-84361

CVE-2026-84361 updated by NVD

Published
2026-09-08
Modified
2026-09-11
EPSS percentile
34%
Sources
github-advisory, nvd

Summary

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

Affected packages

EcosystemPackageAffected versionsFixed versions
Packagistcomposer/composer2.10.3, 2.2.30

Remediation: Upgrade to 2.10.3 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.