Critical PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released
Maintenance teams have disclosed two serious security flaws in Composer, the dependency manager for PHP, which can be exploited to run arbitrary shell commands. Both issues are command-injection problems rooted in the Perforce VCS driver implementation.
The first flaw, tracked as CVE-2026-40176 and rated CVSS 7.8, stems from insufficient validation of repository configuration data. An attacker who can supply a crafted composer.json that declares a Perforce VCS repository could inject commands that execute under the privileges of the user invoking Composer.
The second issue, CVE-2026-40261 with a CVSS score of 8.8, is caused by inadequate escaping. An adversary could embed shell metacharacters inside a manipulated source reference, allowing arbitrary command execution when Composer processes that value.
Composer maintainers warn that in both scenarios the injected payloads would be executed even on systems where Perforce itself is not installed, because the vulnerable code paths run regardless of the Perforce client being present.
The vulnerabilities affect these release ranges and are fixed in the noted versions:
- >= 2.3, < 2.9.6 (patched in 2.9.6)
- >= 2.0, < 2.2.27 (patched in 2.2.27)
If applying the fixes immediately is not practical, Composer users are advised to manually review composer.json files before executing Composer commands and ensure any Perforce-related fields contain only legitimate values. Additional precautions include using only trusted package repositories, running Composer only on projects from verified sources, and avoiding installations that prefer distribution archives by not using the “–prefer-dist” flag or the “preferred-install: dist” configuration.
Composer said it scanned packages on Packagist.org and did not find evidence that attackers have exploited these bugs by publishing packages containing malicious Perforce metadata. The project also expects to ship an updated release for Private Packagist Self-Hosted customers.
As a preventive measure, publication of Perforce source metadata on Packagist.org has been disabled since Friday, April 10th, 2026. Composer maintainers emphasize that all installations should be updated immediately regardless of whether Perforce metadata is present.