CVE-2026-84361: Composer Arbitrary Command Execution via Malicious Package's Perforce Source URL
Summary
CVE-2026-84361: Composer arbitrary command execution via a malicious package's Perforce source URL. Affects composer/composer across 2 version ranges.
>= 1.0, < 2.2.30
>= 2.3.0, < 2.10.3
Fixed in 2.2.30 or 2.10.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Composer is a widely used dependency manager for PHP, allowing developers to manage libraries and packages easily. It enables the installation, updating, and management of dependencies in PHP projects. However, Composer's integration with version control systems like Perforce can introduce vulnerabilities if not properly secured. This specific vulnerability arises from Composer's handling of Perforce source URLs, which can be exploited if the p4 command line client is installed on the user's machine.
Vulnerability Detail
The vulnerability allows an attacker to execute arbitrary commands on a system running Composer if the p4 Perforce CLI client is installed. This occurs when Composer processes a malicious package that contains a Perforce source URL. Composer does not validate these URLs adequately, allowing them to be crafted in a way that instructs the p4 client to run local commands instead of connecting to a server. This can lead to remote code execution with the privileges of the user or CI account running Composer, posing a significant security risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0, < 2.2.302.2.30composer require composer/composer:2.2.30 -
>= 2.3.0, < 2.10.32.10.3composer require composer/composer:2.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, you can mitigate the risk by removing the p4 client from the PATH of machines running Composer that do not use Perforce. This will block the specific attack vector associated with this vulnerability. Additionally, restrict configured repositories to trusted sources and treat lock files from untrusted sources as untrusted input.
Conclusion
CVE-2026-84361 presents a significant risk for users of Composer who have the p4 client installed. It is crucial to update to the patched versions to mitigate this vulnerability. Users should also consider implementing workarounds to reduce their exposure until they can upgrade.
See every vulnerability recorded for composer/composer →
FAQ
CVE-2026-84361 is a vulnerability in Composer that allows arbitrary command execution via malicious Perforce source URLs.
Users with the p4 Perforce CLI client installed and those relying on untrusted Composer repositories are at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
As a temporary measure, remove the p4 client from the PATH and restrict your Composer repositories to trusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for composer/composer.
