Listen to this Post
Composer is a dependency manager for the PHP language. A remote code execution vulnerability exists in Composer versions from 1.0 up to (but not including) 2.2.30 and 2.10.3. If the Perforce `p4` CLI client is installed on the system, a malicious dependency package from a package repository that allows arbitrary Perforce source URLs can execute arbitrary commands when running `composer install` or composer update.
The root cause is that Composer passed a package’s Perforce source address to the `p4` CLI client without validating it. The `p4` CLI client accepts addresses that mean “run this local command” instead of “connect to this server”. Specifically, a malicious package can set `source.type` to `perforce` and `source.url` to an `rsh:` or `jsh:` P4PORT value. When Composer installs the package from source (either because it has no dist artifact or because `–prefer-source` is selected), the `Composer\Util\Perforce` class passes the address to `p4` without validation, causing `p4` to run a local command with the privileges of the user or CI account running Composer.
Packagist.org does not allow Perforce source metadata, so projects that only consume packages from Packagist.org are not affected. The most realistic attack vector is a developer workstation or CI image that has Perforce tooling installed, pulling packages from a private or third-party Composer repository that an attacker has compromised. This vulnerability is fixed in Composer versions 2.10.3 and 2.2.30.
DailyCVE Form:
Platform: Composer (PHP)
Version: 1.0 – 2.2.29, 2.3.0 – 2.10.2
Vulnerability: Remote Code Execution (RCE)
Severity: High (CVSS 7.7)
Date: September 2026
Prediction: Patch already released (Sep 2026)
What Undercode Say:
Check if p4 CLI is installed and on PATH which p4 Check Composer version composer --version Vulnerable versions range Composer < 2.2.30 or < 2.10.3 are affected Upgrade to patched version composer self-update --2.2.30 for LTS composer self-update --2.10.3 for latest Verify upgrade composer --version
Exploit: (Educational Purposes!)
An attacker would compromise a custom Composer repository or provide an untrusted `composer.lock` file containing a package with:
{
"name": "malicious/package",
"source": {
"type": "perforce",
"url": "rsh:; malicious-command-here;",
"reference": "some-ref"
}
}
When a victim runs `composer install` or `composer update` (with `–prefer-source` or if no dist artifact exists), Composer passes the `rsh:; malicious-command-here;` address to the `p4` client, which executes the command with the victim’s privileges.
Protection:
- Upgrade Composer to version 2.10.3 or 2.2.30 immediately.
- If unable to upgrade, remove the `p4` client from the PATH of machines running Composer that do not use Perforce.
- Restrict configured repositories to sources you control or trust.
- Treat `composer.lock` files from untrusted sources as untrusted input.
Impact:
- Remote Code Execution with the privileges of the user or CI account running Composer.
- Supply chain compromise – attackers can compromise private or third-party Composer repositories to inject malicious packages.
- Affected environments – primarily developer workstations and CI/CD pipelines that have the Perforce `p4` CLI installed.
- Wide version range – all Composer versions from 1.0 through 2.2.29 and 2.3.0 through 2.10.2 are vulnerable.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
