CVE-2026-84361: Composer Dependency Manager RCE Vulnerability

CVE-2026-84361 Overview

CVE-2026-84361 is a command injection vulnerability [CWE-78] in Composer, the dependency manager for PHP. A malicious dependency package from a custom Composer repository or an untrusted composer.lock file can set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When Composer installs the package from source with the Perforce p4 client installed, Composer\Util\Perforce passes the address to p4 without validation, causing p4 to execute a local command with the privileges of the user or CI account. The issue affects Composer from version 1.0 up to 2.2.30 and 2.10.3.

Critical Impact
Attackers can achieve arbitrary command execution on developer workstations and CI/CD build agents through malicious dependency metadata processed by composer install or composer update.

Affected Products

Composer 1.0 through versions prior to 2.2.30 (2.2.x branch)
Composer versions prior to 2.10.3 (2.x branch)
Systems with the Perforce p4 client installed alongside Composer

Discovery Timeline

2026-09-01 - CVE-2026-84361 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84361

Vulnerability Analysis

The vulnerability resides in Composer\Util\Perforce, which builds and executes Perforce p4 client commands using values sourced from package metadata. Composer accepts a source.url field that maps to the P4PORT connection string. The Perforce protocol supports rsh: and jsh: transport prefixes, which instruct p4 to launch an arbitrary local command as the transport channel. Because Composer did not validate the source.url value before passing it to p4, an attacker who controls package metadata could inject a shell command that runs with the privileges of the invoking user.

Exploitation requires either a malicious custom Composer repository or an untrusted composer.lock file, combined with the presence of the p4 binary. Packagist.org rejects Perforce source metadata, so the primary exposure is private or third-party repositories referenced during composer install, composer update, or installs using --prefer-source. CI/CD pipelines that automatically resolve dependencies are particularly exposed because build agents typically run with broad filesystem and network access.

Root Cause

The root cause is missing input validation on the P4PORT value derived from untrusted package metadata. Composer\Util\Perforce treated source.url as a trusted transport string and forwarded it to p4 without rejecting the command-executing rsh: and jsh: prefixes. This maps to [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Attack Vector

An attacker publishes a package to a custom Composer repository (or crafts a poisoned composer.lock) that declares:

source.type set to perforce
source.url set to a string beginning with rsh: or jsh: followed by an attacker-controlled command

When a victim runs composer install or composer update on a system with the p4 client installed, p4 interprets the transport prefix and executes the embedded command as the current user.

php

// Patch: src/Composer/Util/Perforce.php
namespace Composer\Util;

use Composer\Exception\SecurityException;
use Composer\IO\IOInterface;
use Composer\Pcre\Preg;
use Symfony\Component\Process\Process;

Source: GitHub Commit Fix

The fix introduces a new SecurityException path in Composer\Util\Perforce and adds Perforce validation into ValidatingArrayLoader, causing Composer to reject unsafe P4PORT values before invoking the p4 binary.

php

// Patch: src/Composer/Package/Loader/ValidatingArrayLoader.php
use Composer\Package\Version\VersionParser;
use Composer\Repository\PlatformRepository;
use Composer\Spdx\SpdxLicenses;
use Composer\Util\Perforce;

Source: GitHub Commit Update

Detection Methods for CVE-2026-84361

Indicators of Compromise

Occurrences of source.url strings beginning with rsh: or jsh: in composer.json or composer.lock files across repositories.
Unexpected child processes of p4 or composer on developer workstations and CI runners, especially shells such as sh, bash, or powershell.
Outbound network connections initiated from Composer or p4 processes to hosts unrelated to internal Perforce infrastructure.
New or modified files in home directories, SSH configurations, or CI credential stores immediately following a Composer install run.

Detection Strategies

Scan source code repositories and lockfiles for the pattern "type"\s*:\s*"perforce" combined with a source.url starting with rsh: or jsh:.
Build endpoint detection rules that alert on p4 spawning interactive shells or scripting interpreters, which is atypical for legitimate Perforce workflows.
Correlate composer install and composer update invocations with unexpected process trees during CI job execution.

Monitoring Recommendations

Enable process command-line auditing on build agents and developer endpoints to capture p4 invocations with full arguments.
Forward Composer, p4, and shell process telemetry to a centralized analytics platform for retrospective hunting.
Baseline dependency resolution activity in CI pipelines and alert on deviations such as new custom repositories or lockfile churn.

How to Mitigate CVE-2026-84361

Immediate Actions Required

Upgrade Composer to version 2.2.30 on the 2.2.x branch or 2.10.3 on the 2.x branch immediately.
Audit all composer.json and composer.lock files for Perforce source entries and reject any source.url beginning with rsh: or jsh:.
Restrict Composer builds to trusted repositories and require signed or reviewed lockfile changes in CI.
Rotate credentials accessible from developer workstations and CI agents if malicious Perforce metadata is discovered in history.

Patch Information

The maintainers released fixes in Composer 2.2.30 and Composer 2.10.3. Technical details are described in GHSA-rvx4-ffvw-m9q3. The fix adds a SecurityException in Composer\Util\Perforce and integrates Perforce URL validation into ValidatingArrayLoader so unsafe P4PORT values are rejected during metadata loading.

Workarounds

Uninstall or remove the Perforce p4 client from systems that do not require it, which prevents the vulnerable code path from executing.
Avoid --prefer-source installs on untrusted projects until patched Composer versions are deployed.
Pin Composer to a patched version in CI images and enforce version checks at pipeline start.

bash

# Upgrade Composer to a patched version
composer self-update 2.10.3
# Or for the 2.2.x LTS branch
composer self-update 2.2.30

# Verify installed version
composer --version

# Audit lockfiles for vulnerable Perforce source entries
grep -RIn -E '"type"\s*:\s*"perforce"' .
grep -RIn -E '"url"\s*:\s*"(rsh|jsh):' .