Vulnerability Description
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
Related Weaknesses (CWE)
References
- https://github.com/composer/composer/commit/0aac50528e83ed635cf78833363589746944
- https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e5
- https://github.com/composer/composer/releases/tag/2.10.3
- https://github.com/composer/composer/releases/tag/2.2.30
- https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3
FAQ
What is CVE-2026-84361?
CVE-2026-84361 is a documented vulnerability. Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set s...
How severe is CVE-2026-84361?
CVSS scoring is not yet available for CVE-2026-84361. Check NVD for updates.
Is there a patch for CVE-2026-84361?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.