CVE-2026-84361: Composer: Perforce source URL permits P4PORT `rsh:` command execution

Severity: high (CVSS 7.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-01 · updated 2026-09-09
Weakness: CWE-78

Description

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

Affected products

Packagist Composer/Composer: from 2.3.0 before 2.10.3; from 1.0 before 2.2.30; 2.10.0, 2.10.0-RC1, 2.10.0-RC2, 2.10.1, 2.10.2, 2.3.0 (+228) — fixed in 2.10.3, 2.2.30
composer: from 1.0, < 2.2.30; from 2.3.0, < 2.10.3

How to fix

Upgrade to a fixed version: Packagist Composer/Composer 2.10.3, 2.2.30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-84361 or the next vulnerability affects your stack