CVE-2026-84361 Composer: Perforce source URL permits P4PORT `rsh:` command execution
A malicious package can execute arbitrary commands via Perforce source URLs if the p4 client is installed, allowing attackers to run code with user privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-84361?
CVE-2026-84361 is a high-severity command injection vulnerability in composer, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
Weakness: CWE-78
Which versions are affected by CVE-2026-84361?
5 open source packages ship an affected version, including composer/composer and composer.
| Package | Affected | Fixed in |
|---|---|---|
composer/composer Packagist | From 1.0 | 2.2.30 |
composer/composer Packagist | From 1.0 | 2.2.30 |
composer/composer Packagist | From 2.3.0 | 2.10.3 |
composer/composer Packagist | From 2.3.0 | 2.10.3 |
composer Bitnami | From 1.0.0 | 2.2.30, 2.10.3 |
Linux distribution packages (7)
php-composer2 SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | All versions | 2.6.4-150600.3.18.1 |
php-composer2 SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 2.6.4-150600.3.18.1 |
php-composer2 SUSE:Linux Enterprise Server 16.0 | All versions | 2.8.9-160000.5.1 |
php-composer2 SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 2.6.4-150600.3.18.1 |
php-composer2 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.8.9-160000.5.1 |
php-composer2 openSUSE:Leap 16.0 | All versions | 2.8.9-160000.5.1 |
php-composer2 openSUSE:Tumbleweed | All versions | 2.10.3-2.1 |
How do I fix CVE-2026-84361?
Upgrade composer/composer to a fixed version for your release line: 2.2.30 or 2.10.3.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-84361 being exploited?
There is no known exploitation of CVE-2026-84361 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as BIT-composer-2026-84361, DEBIAN-CVE-2026-84361, GHSA-rvx4-ffvw-m9q3, MINI-3hjh-7xq3-45jr, MINI-5hm4-49pw-qc98, SUSE-SU-2026:23635-1 and 4 more.