Skip to content
Threat Feed
Subscribe

Product

Composer (>= 1.0, < 2.2.30)

1 brief RSS
high advisory

Arbitrary Command Execution in Composer via Malicious Perforce Source URLs

Composer versions before 2.10.3 and 2.2.30 are vulnerable to remote code execution when the Perforce CLI client is installed and a malicious package metadata source URL is processed (CVE-2026-84361).

composer +1 supply-chain rce php
1t 1c