Composer: Perforce source URL permits P4PORT rsh: command execution
Summary
CVE-2026-84361: Composer: Perforce source URL permits P4PORT rsh: command execution. Affects composer across 2 version ranges.
>= 1.0.0, < 2.2.30
>= 2.3.0, < 2.10.3
Fixed in 2.2.30 or 2.10.3, depending on the release line you run. How to fix ↓
Also tracked for
- composer/composer · Packagist
The same CVE-2026-84361 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 2.2.302.2.30 -
>= 2.3.0, < 2.10.32.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
References
Related vulnerabilities
Recent vulnerabilities recorded for composer.
