CVE-2026-40176 - Vulnerability Analysis

Overview

Composer 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection caused by improper escaping of user-supplied Perforce connection parameters in Perforce::generateP4Command(), letting attackers execute arbitrary commands via malicious composer.json files, exploit requires running Composer on untrusted projects.

Severity & Score

Impact

Attackers can execute arbitrary commands as the user running Composer, potentially compromising the system.

Mitigation

Update to Composer 2.2.27 or 2.9.6 or later.

References

• https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p
• https://github.com/composer/composer/releases/tag/2.9.6

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner