VYPR
← All advisories
High severity7.8NVD Advisory· Published Apr 15, 2026· Updated Apr 25, 2026

CVE-2026-40176

CVE-2026-40176

Description

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
composer/composerPackagist
>= 2.3.0, < 2.9.62.9.6
composer/composerPackagist
>= 1.0.0, < 2.2.272.2.27

Affected products

1
  • Composer/Composer
    cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*
    Range: >=1.0.0,<=2.2.26

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

27