CVE-2026-84361

Composer handed a package's Perforce source address to the p4 CLI client without validating it, and p4 interprets certain address strings as 'run this local command' rather than 'connect to this server', enabling OS command injection (CWE-78). It is triggered during `composer install` or `composer update` when three conditions hold: the p4 client is installed and on PATH, the package's perforce-type source metadata comes from a repository the attacker controls or influenced (Packagist.org disallows perforce source metadata, so it is not a vector), and the package is installed from source, e.g. via --prefer-source or a missing dist artifact, including from an untrusted composer.lock. An attacker gains arbitrary command execution with the privileges of the developer or CI account running Composer. Only environments with Perforce tooling present and non-Packagist repository sources are affected, which the advisory describes as a small minority of Composer users. No public proof-of-concept, CISA KEV listing, or known exploitation exists; EPSS is 0.4% and fixes are available in Composer 2.10.3 and 2.2.30.

What to do: Upgrade to Composer 2.10.3 (or 2.2.30 on the 2.2 branch); note that legitimate non-standard P4PORT values will now be rejected. Until upgraded, remove the p4 client from the PATH of Composer/CI machines that do not use Perforce — this fully blocks the attack — and restrict configured repositories to trusted sources, treating composer.lock files from untrusted origins as untrusted input. Audit developer workstations and CI images for the presence of p4 to gauge exposure.