CVE-2026-84361: Composer: Perforce source URL permits P4PORT `rsh:` command execution
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.10.3 - Compensating control
Ensure Composer dependencies are only installed from trusted Composer repositories and do not use untrusted composer.lock files that could define source.type as perforce with source.url set to an rsh: or jsh: P4PORT value.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users and CI accounts are exposed when they install from a custom Composer repository or use an untrusted composer.lock file, have the Perforce p4 client installed, and Composer installs the malicious package from source. Packagist.org packages are not a source of this issue because Packagist.org does not permit Perforce source metadata.
What does an attacker need to control?
An attacker needs to supply malicious dependency metadata through a custom Composer repository or an untrusted lock file. The package must specify source.type as perforce and use an rsh: or jsh: value in source.url.
When does the command execute, and under which account?
Execution occurs when Composer runs composer install or composer update and installs the package from source, including when --prefer-source is used. The p4 client runs the local command with the privileges of the user or CI account running Composer.
Which Composer versions contain the fix?
The issue is fixed in Composer versions 2.2.30 and 2.10.3.