CVE-2026-40176High· 7.8▾ MidnightPoC availableComposer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supp…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.0%
3 GitHub repos (last check)
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).
composer >= 2.3, < 2.9.6composer >= 1.0, < 2.2.27Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
composer/composer >= 2.3.0, < 2.9.6composer/composer >= 1.0.0, < 2.2.27Patched in:
composer/composer 2.9.6composer/composer 2.2.27Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59944Medium· 6.1Composer is a dependency Manager for the PHP language
CVE-2026-84361HighComposer is a dependency Manager for the PHP language
CVE-2026-109153Medium· 6.3A vulnerability was detected in MosaicML Composer up to 0.32.1
CVE-2018-19949Critical· 9.8If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
CVE-2024-31449High· 7.0Lua library commands may lead to stack overflow and RCE in Redis