CVE-2026-84361: 
PHP vulnerability analysis and mitigation

CVE-2026-84361 is an OS command injection vulnerability in Composer, the PHP dependency manager, that allows arbitrary command execution via a malicious package's Perforce source URL. Affecting versions 1.0 through 2.2.29 and 2.3.0 through 2.10.2, the flaw was published on September 1, 2026, and patched in versions 2.2.30 and 2.10.3 released on August 27, 2026. It carries a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper input validation (CWE-78: OS Command Injection) in Composer\Util\Perforce, which passed a package's source.url field directly to the Perforce p4 CLI client as the P4PORT value without sanitization. The p4 client natively interprets rsh: and jsh: prefixed addresses as instructions to spawn a local child process and communicate over its stdio, rather than connecting to a network server — meaning an attacker-controlled value like rsh:touch /tmp/pwned causes arbitrary local command execution without any shell metacharacter injection. The fix adds a Perforce::isValidPort() method that enforces only legitimate network endpoint forms ([tcp|ssl:][host:]port) and rejects rsh:/jsh: transports at three enforcement points: the Perforce constructor, checkServerExists(), and ValidatingArrayLoader (GitHub Advisory, Patch Commit).

Successful exploitation results in arbitrary local command execution with the full privileges of the user or CI/CD account running composer install or composer update. An attacker who can control a package's source metadata in a custom Composer repository, or who can supply a crafted composer.lock file, can achieve complete confidentiality, integrity, and availability compromise of the affected system. This is particularly dangerous in CI/CD pipelines where Composer runs with elevated service account privileges, potentially enabling lateral movement within build infrastructure (GitHub Advisory).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires three concurrent conditions: the Perforce p4 client must be installed and on the system PATH, the victim must use a non-Packagist Composer repository (or an untrusted composer.lock), and the package must be installed from source. Packagist.org explicitly does not permit Perforce source metadata, significantly limiting the attack surface to environments using private or third-party Composer repositories (GitHub Advisory).

1. Identify a target environment: Determine that the target developer workstation or CI system has the Perforce p4 client installed and on the PATH, and uses a custom (non-Packagist) Composer repository or consumes untrusted composer.lock files.
2. Craft a malicious package: Create or compromise a package in the target's custom Composer repository, setting source.type to perforce and source.url to a command-executing value such as rsh:touch /tmp/pwned or rsh:/path/to/malicious.sh.
3. Trigger source installation: Wait for or social-engineer the victim into running composer install, composer update, or any command with --prefer-source that resolves the malicious package from source (e.g., packages without a dist artifact).
4. Achieve code execution: Composer's Util\Perforce passes the unvalidated source.url to the p4 client as P4PORT; the p4 client interprets the rsh: prefix and executes the remainder as a local command with the privileges of the Composer process — enabling reverse shells, credential theft, or CI pipeline compromise (GitHub Advisory, Patch Commit).

• Process: Unexpected child processes spawned by the Composer PHP process, particularly shell commands, scripts, or network tools (e.g., bash, sh, curl, wget, nc) that are not typical of a dependency installation workflow.
• File System: Unexpected new files created in /tmp/ or other world-writable directories during or immediately after a composer install/composer update run; new cron jobs, SSH authorized keys, or startup scripts added by the Composer process user.
• Logs: System audit logs (e.g., auditd) showing p4 spawning unusual child processes; Composer output logs referencing Perforce source URLs containing rsh: or jsh: prefixes.
• Network: Unexpected outbound connections from the build server or developer workstation to attacker-controlled infrastructure initiated by processes spawned during a Composer dependency installation.
• Configuration: Presence of source.type: perforce with a source.url value beginning with rsh: or jsh: in any composer.json or composer.lock file in the project (GitHub Advisory).

Upgrade Composer to version 2.2.30 (for the LTS branch) or 2.10.3 (for the current branch) or later, which validate Perforce source URLs before passing them to the p4 client (Release 2.10.3, Release 2.2.30). As an immediate workaround without upgrading, remove the p4 Perforce client from the PATH of any machine running Composer that does not actively use Perforce — this fully eliminates the attack vector since the vulnerability requires the p4 binary to be present. Additionally, restrict Composer repositories to only trusted sources you control, and treat composer.lock files from untrusted origins as untrusted input (GitHub Advisory).

The vulnerability was reported by security researcher Saku0512 and credited in the GitHub Security Advisory (GitHub Advisory). Red Hat tracked the issue and published a corresponding CVE advisory (Red Hat CVE). No significant broader media coverage or notable community controversy has been identified at this time.