CVE-2026-84361: Composer

High severity, CVSS 7.7. EPSS: 0.5% chance of exploitation in the next 30 days.

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

Affected products

• Composer Composer: from 1.0, before 2.2.30 (fixed in 2.2.30); from 2.3.0, before 2.10.3 (fixed in 2.10.3)

Published 2026-09-01. Last modified 2026-09-09.