CVE-2026-84361
Fixed in a distro release EPSS <1%CVSS 7.7
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
Products: composer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | composer/composer | 2.10.3 |
| Packagist | composer/composer | 2.2.30 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | composer | no fix |
| Debian:13 | composer | no fix |
| Debian:14 | composer | 2.10.3-1 |
| Red Hat:hummingbird:1 | composer | 0:2.10.3-1.hum1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | php-composer2 | 2.6.4-150600.3.18.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | php-composer2 | 2.6.4-150600.3.18.1 |
| SUSE:Linux Enterprise Server 16.0 | php-composer2 | 2.8.9-160000.5.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | php-composer2 | 2.2.30-150400.3.21.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | php-composer2 | 2.6.4-150600.3.18.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | php-composer2 | 2.8.9-160000.5.1 |
| Ubuntu:26.04:LTS | composer | no fix |
| Ubuntu:26.10 | composer | no fix |
| Ubuntu:Pro:16.04:LTS | composer | no fix |
| Ubuntu:Pro:18.04:LTS | composer | no fix |
| Ubuntu:Pro:20.04:LTS | composer | no fix |
| Ubuntu:Pro:22.04:LTS | composer | no fix |
| Ubuntu:Pro:24.04:LTS | composer | no fix |
| openSUSE:Leap 16.0 | php-composer2 | 2.8.9-160000.5.1 |
| openSUSE:Tumbleweed | php-composer2 | 2.10.3-2.1 |