Composer: Malicious Package Can Run Commands via a Perforce Source URL

Published as "Composer arbitrary command execution via a malicious package's Perforce source URL"

high Composer · Last reviewed Nov 1, 2026

CVE: CVE-2026-84361
GHSA: GHSA-rvx4-ffvw-m9q3
Packagist: PKSA-ym19-cy3j-z6df
Reported: Sep 8, 2026

Lets a malicious package run commands during composer install on machines with the p4 client, when it comes from a repository other than Packagist.org.

Affected and fixed versions

In composer/composer. Find the row for the version you run, and update to the release next to it.

If you run	Update to	Support
2.3.0 – 2.10.2	2.10.3	Supported

Show 1 older branch, no longer supported

1.0 – 2.2.29

2.2.30

Upgrade

Run the line for the branch you are on.

composer require composer/composer:^2.10.3

What this means

A malicious package can run commands on your machine during composer install or composer update, with the rights of the user or CI account running Composer. Composer handed a package's Perforce source address to the p4 client without checking it, and p4 accepts addresses that start a local command.

Who is affected

The Composer advisory says you're only exposed when all of these are true:

The Perforce p4 command line client is installed and on the PATH where Composer runs.
An attacker controls a package's Perforce source details. Packagist.org doesn't allow those, so this needs another Composer repository, an inline package repository, or a composer.lock from a source you don't trust.
The package is installed from source, because it has no dist archive or you use --prefer-source.

Machines without p4, and projects that only use Packagist.org, aren't affected.

What to do

Update composer/composer to 2.10.3, or to 2.2.30 if you stay on 2.2 or older. Composer says upgrading is the only complete fix. Until you can, remove p4 from the PATH on machines that don't use Perforce, and only use repositories and lock files you trust.

The fix only accepts real network addresses for Perforce. An unusual P4PORT value that isn't a plain host and port is now rejected.

Reported by Saku0512.

Check your app with an agent

Paste this into a coding agent that can read your project, such as Claude Code, Codex or Amp. It checks your composer.lock against the versions above and tells you what to update, without changing anything.

Check whether the PHP project you have access to is affected by this security advisory, and tell me what to update. Do a read-only check: don't edit files, don't run composer update or composer require, and don't try to reproduce the flaw.

Advisory: Composer: Malicious Package Can Run Commands via a Perforce Source URL (CVE-2026-84361, GHSA-rvx4-ffvw-m9q3)
Details: https://phpnews.net/security/composer/ghsa-rvx4-ffvw-m9q3

Affected versions, as Composer constraints:
- composer/composer: >=1.0,<2.2.30|>=2.3.0,<2.10.3

Fixed releases on branches that still get security fixes:
- 2.3.0 – 2.10.2: update to 2.10.3

1. Find every composer.lock in the project outside vendor/ (a monorepo can have one per app) and read the installed version of each package above. Packages installed as dependencies of other packages count too.
2. Compare each installed version with its constraint: "|" separates alternative ranges, and "," means both bounds apply.
3. For each affected install, read "What this means" at https://phpnews.net/security/composer/ghsa-rvx4-ffvw-m9q3 and check whether the project meets the conditions it describes (a feature in use, a config value, a driver). Say which conditions you could check and which you couldn't.
4. Report a table: lock file | package | installed version | affected (yes, no or unknown) | conditions met (yes, no or unknown) | update to | evidence. For each affected package, give the command that would fix it, without running it: composer update <package> --with-dependencies when it is only installed as a dependency of another package, or composer require with the fixed version when composer.json requires it directly. If the installed version is on a branch with no fixed release listed, say it needs a move to a newer branch.

Sources

← All Composer advisories