Command Injection Vulnerability in Composer Dependency Manager by Composer
CVE-2026-84361
7.7HIGH
What is CVE-2026-84361?
A command injection vulnerability exists in Composer, the PHP dependency manager, affecting versions up to 2.2.30 and 2.10.3. Malicious dependency packages from untrusted sources can manipulate Composer's configuration to pass unsafe commands to the Perforce p4 client. This occurs when Composer installs packages with an unvalidated source type and URL, allowing an attacker to execute local commands with the privileges of the user or CI account. The issue has been addressed in the latest releases of Composer, specifically versions 2.2.30 and 2.10.3.
Affected Version(s)
composer >= 1.0, < 2.2.30 < 1.0, 2.2.30
composer >= 2.3.0, < 2.10.3 < 2.3.0, 2.10.3