CVE-2026-84361— Composer: Perforce source URL permits P4PORT `rsh:` command execution
Quick assessment
Affected
composer composer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Composer 是 PHP 语言的依赖管理工具。在 1.0 至 2.2.30 和 2.10.3 之前的版本中，来自自定义 Composer 仓库或不可信的 文件的恶意依赖包可能将 设置为 ，并将 设置为以 或 开头的 P4PORT 值。当系统安装了 Perforce 的 p4 客户端，且通过 或 （包括 选项）从源码安装该包时， 未对地址进行验证，直接将其传递给 p4，导致 p4 以当前用户或 CI 账户的权限执行本地命令。Packagist.org 不允许使用 Perforce 源码元数据。此问题已在 2.2.
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84361
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Composer: Perforce source URL permits P4PORT `rsh:` command execution
Source: CVE Program / CVE List V5
Vulnerability Description
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-84361
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84361
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-84361 (2)
-
-
🔗 Merge commit from fork · composer/composer@199ad81 · GitHub x_refsource_MISC
Vendor Advisories for CVE-2026-84361 (1)
Vendor Pages for CVE-2026-84361 (2)
-
-
🔗 Release 2.10.3 · composer/composer · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: composer
-
CVE-2026-45793
Composer: Github Actions issued GITHUB_TOKEN disclosure in G -
CVE-2026-11914
Composer - Critical - Unsupported - SA-CONTRIB-2026-046 -
CVE-2026-59947
Composer: URL-embedded HTTP-Basic username leaks to verbose -
CVE-2026-59948
Composer: Arbitrary file write outside vendor via malicious -
CVE-2026-59946
Composer: Path traversal in package bin field lets dependenc
Same vendor: composer
-
CVE-2026-45793
Composer: Github Actions issued GITHUB_TOKEN disclosure in G -
CVE-2026-59947
Composer: URL-embedded HTTP-Basic username leaks to verbose -
CVE-2026-59948
Composer: Arbitrary file write outside vendor via malicious -
CVE-2026-59946
Composer: Path traversal in package bin field lets dependenc -
CVE-2026-40261
Composer has Command Injection via Malicious Perforce Refere
V. Comments for CVE-2026-84361
No comments yet