Read the docs
TI-2026-57973 Aliases CVE-2026-84361GHSA-rvx4-ffvw-m9q3

Composer: Perforce source URL permits P4PORT `rsh:` command execution

Priority LOW 36CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00502 43rd percentileScored 2026-11-07
Fix Fixed composer (composer): 2.2.30, 2.10.3composer/composer (Packagist): 2.10.3, 2.2.30Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
composercomposer1.0 to before 2.2.30; 2.3.0 to before 2.10.32.2.30, 2.10.3Patch availableCNA
—composer/composer (Packagist)2.3.0 to before 2.10.32.10.3Patch availableGHSA-rvx4-ffvw-m9q3
—composer/composer (Packagist)1.0 to before 2.2.302.2.30Patch availableGHSA-rvx4-ffvw-m9q3
  • composer Vendorcomposer Affected 1.0 to before 2.2.30; 2.3.0 to before 2.10.3 Fixed in 2.2.30, 2.10.3 Patch available CNA
  • composer/composer (Packagist) Vendor— Affected 2.3.0 to before 2.10.3 Fixed in 2.10.3 Patch available GHSA-rvx4-ffvw-m9q3
  • composer/composer (Packagist) Vendor— Affected 1.0 to before 2.2.30 Fixed in 2.2.30 Patch available GHSA-rvx4-ffvw-m9q3

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*——composer
  • cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:* Versions — — ·composer

Remediation

  • Fix · CNA composer (composer) Fixed in 2.2.30, 2.10.3
  • Fix · GHSA-rvx4-ffvw-m9q3 composer/composer (Packagist) Fixed in 2.10.3 Advisory →
  • Fix · GHSA-rvx4-ffvw-m9q3 composer/composer (Packagist) Fixed in 2.2.30 Advisory →

Red Hat 1 advisory

  • RHSA-2026:63151 Released 2026-09-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images composer-2.10.3-1.hum1@noarch@public-hummingbird-aarch64-rpms, composer-2.10.3-1.hum1@noarch@public-hummingbird-x86_64-rpms, composer-2.10.3-1.hum1@src

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:63151

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84361
  2. 2026-10-03 Alias added: GHSA-rvx4-ffvw-m9q3

References

Advisory 1

Other 6

  • TI-2015-06892 Composer before 2016-02-10 allows cache poisoning from other projects built on the same… CVSS 3.1HIGH 8.8
  • TI-2021-17955 Command injection in composer on Windows CVSS 3.1CRITICAL 9.8
  • TI-2024-23311 Composer vulnerable to command injection via malicious git/hg branch names CVSS 3.1HIGH 8.8
  • TI-2021-10185 Code injection in composer CVSS 3.1HIGH 8.8
  • TI-2022-08641 Missing input validation can lead to command execution in composer CVSS 3.1HIGH 8.8
  • TI-2026-29055 Composer has Command Injection via Malicious Perforce Reference CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences