CVE-2026-84361

Name	CVE-2026-84361
Description	Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
composer (PTS)	bookworm	2.5.5-1+deb12u5	vulnerable
	bookworm (security)	2.5.5-1+deb12u2	vulnerable
	trixie	2.8.8-1+deb13u3	vulnerable
	forky, sid	2.10.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
composer	source	(unstable)	2.10.3-1

Notes

[trixie] - composer <no-dsa> (Minor issue)
https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3
Fixed by: https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220 (2.10.3)
Fixed by: https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af (2.2.30)