Which versions of Composer are affected by CVE-2026-84361?

PHP Composer versions 1.0-2.2.29 and 2.10.2 contain a command injection vulnerability in the Perforce VCS handler that allows arbitrary code execution during package installation with developer and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-84361?

Yes, a public proof-of-concept exploit is available for CVE-2026-84361. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-84361?

Within 24 hours, audit Composer lock files and CI/CD configurations to identify any dependencies explicitly configured with Perforce (p4://) repositories-most PHP teams do not use Perforce and can verify rapid non-exposure. Within 7 days, if Perforce dependencies exist, migrate affected packages to alternative VCS handlers (Git, SVN, Mercurial) or switch to stable package mirror distributions; if no Perforce usage is found, implement a policy blocklist to prevent future installation of Perforce-routed packages. Within 30 days, monitor Composer security advisories for patch availability and prepare upgrade testing for all affected versions once patches are released.

Composer CVE-2026-84361

Q: What is the CVSS score of CVE-2026-84361?

CVE-2026-84361 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-69608 HIGH

OS Command Injection (CWE-78)

2026-09-01 GitHub_M

GHSA-rvx4-ffvw-m9q3

PHP Command Injection Composer

7.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

AC:H because p4 must be installed and a custom repo or untrusted lock file is required; UI:R because the victim must actively run composer install/update.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 09, 2026 - 23:32 vuln.today

Patch available

Sep 01, 2026 - 22:03 EUVD

Source Code Evidence Fetched

Sep 01, 2026 - 21:16 vuln.today

Analysis Generated

Sep 01, 2026 - 21:16 vuln.today

CVE Published

Sep 01, 2026 - 20:06 cve.org

HIGH 7.7

DescriptionCVE.org

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

AnalysisAI

Command injection in PHP Composer's Perforce VCS handler allows arbitrary local command execution with the privileges of the developer or CI account running package installation. Affects all Composer releases from 1.0 through 2.2.29 and 2.10.2; the flaw exploits P4PORT's undocumented rsh:/jsh: transport keywords, which instruct the Perforce p4 client to spawn a local child process instead of connecting to a server, allowing attacker-controlled package metadata to trigger OS command execution. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires three simultaneous conditions: (1) the victim environment must use a custom or private Composer repository, or must process an untrusted `composer.lock` file - Packagist.org explicitly disallows Perforce source metadata, so the default Packagist-only workflow is not affected; (2) the Perforce `p4` client binary must be installed and accessible in the system PATH on the machine running Composer; and (3) Composer must perform a source-based installation of the malicious package, triggered either by the `--prefer-source` flag, by the absence of a dist artifact for the package, or by explicit source install. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 7.7 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:P accurately reflects the attack prerequisites: `AT:P` captures that the Perforce `p4` client must be installed, and `UI:P` captures that the victim must actively run a source-based composer install or update. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Composer 2.2.30 (LTS branch) or 2.10.3 (current branch), both confirmed patched releases available at https://github.com/composer/composer/releases/tag/2.2.30 and https://github.com/composer/composer/releases/tag/2.10.3. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit Composer lock files and CI/CD configurations to identify any dependencies explicitly configured with Perforce (p4://) repositories-most PHP teams do not use Perforce and can verify rapid non-exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PHP

View all

CVE-2019-11043 CRITICAL Emergency POC

9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL Act Now POC

9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not

CVE-2016-1555 CRITICAL Act Now POC

9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear

CVE-2018-11138 CRITICAL Emergency POC

9.8 May 31

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by

CVE-2024-11680 CRITICAL Act Now POC

9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C

CVE-2025-49113 CRITICAL Act Now POC

9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au

CVE-2017-9841 CRITICAL Act Now POC

9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

CVE-2025-0108 HIGH Act Now POC

8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-25296 HIGH Act Now POC

8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2013-4983 CRITICAL Emergency POC

10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

Same weakness CWE-78 – OS Command Injection

View all

CVE-2019-15107 CRITICAL POC

9.8

CVE-2024-51378 CRITICAL POC

9.8

CVE-2014-6271 CRITICAL POC

9.8

CVE-2018-11138 CRITICAL POC

9.8

CVE-2014-6278 HIGH POC

8.8

CVE-2017-6334 HIGH POC

8.8

CVE-2024-50603 CRITICAL POC

10.0

CVE-2024-9474 MEDIUM POC

6.9

Same technique Command Injection

View all

CVE-2024-21887 CRITICAL POC

9.1

CVE-2019-15107 CRITICAL POC

9.8

CVE-2024-51378 CRITICAL POC

9.8

CVE-2012-1823 CRITICAL POC

9.8

CVE-2016-1555 CRITICAL POC

9.8

CVE-2014-6271 CRITICAL POC

9.8

CVE-2024-55956 CRITICAL POC

9.8

CVE-2018-11138 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Module for Web and Scripting 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected

CVE-2026-84361 vulnerability details – vuln.today

Back

Composer CVE-2026-84361

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in PHP

Same weakness CWE-78 – OS Command Injection

Same technique Command Injection

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code