CVE-2026-40261
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed.
Risk Assessment
The risk is remote code execution during dependency installation or update from source, potentially leading to full system compromise. This vulnerability is especially dangerous as it can be triggered by a malicious Composer repository.
Recommendation
Immediately update Composer to version 2.2.27 (LTS) or 2.9.6 (mainline). If immediate update is not possible, avoid installing dependencies from source by using --prefer-dist or the preferred-install: dist config setting, and only use trusted Composer repositories.
Other vulnerabilities in Composer
See all- CVE-2026-45793High
A vulnerability in Composer, a dependency manager for PHP, allows disclosure of GitHub OAuth tokens in error logs. Token validation using a regex rejects GITHUB_TOKEN values containing '-', and the rejected token is interpolated into an exception message, leading to leakage to stderr or CI logs.
- CVE-2026-59948High
A vulnerability in the Composer dependency manager for PHP allows an attacker to write files outside the vendor directory and project during package installation or update. The issue occurs when a package from an untrusted repository (other than Packagist.org or Private Packagist) uses an invalid name that is not properly validated before dependency-resolution results are written.
- CVE-2026-59947Medium
Composer, a dependency manager for PHP, prior to versions 2.2.29 and 2.10.2 leaked credentials (e.g., GitHub tokens) to debug output when run with -vvv verbosity. The issue was due to missing sanitization of username-only URL credentials.
- CVE-2026-59946Medium
A vulnerability in the Composer dependency manager for PHP allows changing permissions of an existing host file to world-readable and world-executable. The issue occurs during package install, update, or require when a package bin entry contains '..' path segments.
- CVE-2026-40176High
Command injection vulnerability in the Perforce::generateP4Command() method in Composer, a dependency manager for PHP. An attacker can inject arbitrary commands through Perforce connection parameters (port, user, client) in a malicious composer.json, leading to command execution in the context of the user running Composer.
Original NVD description (English source)
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the Perforce::generateP4Command() method as in GHSA-wg36-wvj6-r67p / CVE-2026-40176, which interpolates user-supplied Perforce connection parameters (port, user, client) from the source url field without proper escaping. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed. Unlike CVE-2026-40176, the source reference and url are provided as part of package metadata, meaning any compromised or malicious Composer repository can serve package metadata declaring perforce as a source type with malicious values. This vulnerability is exploitable when installing or updating dependencies from source, including the default behavior when installing dev-prefixed versions. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline). If developers are unable to immediately update, they can avoid installing dependencies from source by using --prefer-dist or the preferred-install: dist config setting, and only use trusted Composer repositories as a workaround.