CVE-2026-84361

Composer: Perforce source URL permits P4PORT `rsh:` command execution

Published: Sep 1, 2026Updated: Sep 9, 2026 Sources: CVE List NVDCWE-78

N/ACVSS

NVD MITRE

Description

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

No summary for this CVE yet.

Weaknesses

CWE-78

Affected Products

composer

oss-project

composerLibrary

DevTools & CI / artifact-registry

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-84361?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Execution

View detailed technique mapping

References

https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220

github.com

https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af

github.com

https://github.com/composer/composer/releases/tag/2.10.3

github.com

and 2 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-84361 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows