CVE-2026-84361: Remote Code Execution in Composer Perforce VCS Driver
Vulnerability ID: CVE-2026-84361
CVSS Score: 7.7
Published: 2026-09-08
A critical remote code execution vulnerability exists in the Composer PHP dependency manager due to improper neutralization of command parameters passed to the Perforce CLI client. Unauthenticated attackers can exploit this flaw via crafted package metadata in custom repositories or lock files, triggering arbitrary OS command execution when a user or automated CI/CD pipeline runs Composer commands.
TL;DR
Unauthenticated remote command execution in Composer's Perforce VCS driver via malicious repository configurations or lock files.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-78
- Attack Vector: Network
- CVSS Score: 7.7
- EPSS Score: 0.00409
- Impact: Remote Code Execution (RCE)
- Exploit Status: Proof-of-Concept (PoC) available
- KEV Status: Not listed
Affected Systems
- Composer < 2.2.30
- Composer 2.3.x to < 2.10.3
-
Composer: >= 1.0, < 2.2.30 (Fixed in:
2.2.30) -
Composer: >= 2.3.0, < 2.10.3 (Fixed in:
2.10.3)
Code Analysis
Commit: 0aac505
Fix validation of Perforce repository URLs to prevent command execution
Commit: 199ad81
Ensure isValidPort validation is strictly run on package load
Exploit Details
- GitHub: Authorized-testing PoC repository with simulation script and malicious composer.json setup
Mitigation Strategies
- Upgrade Composer to version 2.2.30 (LTS) or 2.10.3 (Stable) or higher.
- Remove the p4 Perforce command-line utility from systems where Perforce is not required.
- Enforce schema validation on private or custom package registries to block package definitions using the perforce source type with untrusted URL structures.
Remediation Steps:
- Identify systems running vulnerable Composer versions (less than 2.2.30, or between 2.3.0 and 2.10.2).
- Run 'composer self-update' or update via system package manager to acquire version 2.2.30 or 2.10.3+.
- Inspect dependency resolution environments (CI/CD build servers, local workstations) and remove the 'p4' binary if it is not explicitly required.
- Scan local configurations using automated scripts or rules (e.g., YARA or grep) to detect malicious rsh: or jsh: commands in composer.json or composer.lock files.
References
- GitHub Security Advisory GHSA-rvx4-ffvw-m9q3
- Composer Fix Commit (0aac505)
- Composer Fix Commit (199ad81)
- Composer Release 2.10.3
- Composer Release 2.2.30
- Saku0512 Proof of Concept Repository
- PoC README
- PoC composer.json
- PoC php simulation script
Read the full report for CVE-2026-84361 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)