CVE-2026-40261 Composer has Command Injection via Malicious Perforce Reference
Attackers can execute arbitrary commands via malicious package metadata in Composer, affecting developers installing dependencies from source.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40261?
CVE-2026-40261 is a high-severity command injection vulnerability in composer, published on 15 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the Perforce::generateP4Command() method as in GHSA-wg36-wvj6-r67p / CVE-2026-40176, which interpolates user-supplied Perforce connection parameters (port, user, client) from the source url field without proper escaping. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed. Unlike CVE-2026-40176, the source reference and url are provided as part of package metadata, meaning any compromised or malicious Composer repository can serve package metadata declaring perforce as a source type with malicious values. This vulnerability is exploitable when installing or updating dependencies from source, including the default behavior when installing dev-prefixed versions. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline). If developers are unable to immediately update, they can avoid installing dependencies from source by using --prefer-dist or the preferred-install: dist config setting, and only use trusted Composer repositories as a workaround.
Which versions are affected by CVE-2026-40261?
5 open source packages ship an affected version, including composer/composer and composer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
composer/composer Packagist | From 1.0.0 | 2.2.27 |
composer/composer Packagist | From 1.0.0 | 2.2.27 |
composer/composer Packagist | From 2.3.0 | 2.9.6 |
composer/composer Packagist | From 2.3.0 | 2.9.6 |
composer Bitnami | From 1.0.0 | 2.2.27, 2.9.6 |
Products include Getcomposer Composer.
How do I fix CVE-2026-40261?
Upgrade composer/composer to a fixed version for your release line: 2.2.27 or 2.9.6.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-40261 being exploited?
There is no known exploitation of CVE-2026-40261 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in composer
- CVE-2024-24821 Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer
- CVE-2015-8371 Composer allows cache poisoning from other projects built on the same host
- CVE-2021-41116 Command injection in composer on Windows
- CVE-2026-40176 Composer is vulnerable to Command Injection via Malicious Perforce Repository
- CVE-2025-67746 Composer vulnerable to ANSI sequence injection
Sources
Also known as BIT-composer-2026-40261, DEBIAN-CVE-2026-40261, GHSA-gqw4-4w2p-838q, MINI-2jj7-qpww-7f59, MINI-h2qp-83g4-h3f7, UBUNTU-CVE-2026-40261.