CVE-2026-40176
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Command injection vulnerability in the Perforce::generateP4Command() method in Composer, a dependency manager for PHP. An attacker can inject arbitrary commands through Perforce connection parameters (port, user, client) in a malicious composer.json, leading to command execution in the context of the user running Composer.
Risk Assessment
The risk for the organization is that an attacker can execute arbitrary commands if an administrator runs Composer on an untrusted project with a crafted composer.json. This could lead to data theft, malware installation, or full system compromise.
Recommendation
Immediately update Composer to version 2.2.27 (for the LTS branch) or 2.9.6 (for the mainline branch). Avoid running Composer commands on projects from untrusted sources.
Other vulnerabilities in Composer
See all- CVE-2026-45793High
A vulnerability in Composer, a dependency manager for PHP, allows disclosure of GitHub OAuth tokens in error logs. Token validation using a regex rejects GITHUB_TOKEN values containing '-', and the rejected token is interpolated into an exception message, leading to leakage to stderr or CI logs.
- CVE-2026-59948High
A vulnerability in the Composer dependency manager for PHP allows an attacker to write files outside the vendor directory and project during package installation or update. The issue occurs when a package from an untrusted repository (other than Packagist.org or Private Packagist) uses an invalid name that is not properly validated before dependency-resolution results are written.
- CVE-2026-59947Medium
Composer, a dependency manager for PHP, prior to versions 2.2.29 and 2.10.2 leaked credentials (e.g., GitHub tokens) to debug output when run with -vvv verbosity. The issue was due to missing sanitization of username-only URL credentials.
- CVE-2026-59946Medium
A vulnerability in the Composer dependency manager for PHP allows changing permissions of an existing host file to world-readable and world-executable. The issue occurs during package install, update, or require when a package bin entry contains '..' path segments.
- CVE-2026-40261High
Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed.
Original NVD description (English source)
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).