CVE-2026-40261: composer Improper Input Validation
Vulnerability summary
CVE-2026-40261 is a high (CVSS 8.8) Improper Input Validation vulnerability in composer. EPSS estimates a 1.91% chance of exploitation in the next 30 days, higher than 79.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 15-04-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the Perforce::generateP4Command() method as in GHSA-wg36-wvj6-r67p / CVE-2026-40176, which interpolates user-supplied Perforce connection parameters (port, user, client) from the source url field without proper escaping. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed. Unlike CVE-2026-40176, the source reference and url are provided as part of package metadata, meaning any compromised or malicious Composer repository can serve package metadata declaring perforce as a source type with malicious values. This vulnerability is exploitable when installing or updating dependencies from source, including the default behavior when installing dev-prefixed versions. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline). If developers are unable to immediately update, they can avoid installing dependencies from source by using --prefer-dist or the preferred-install: dist config setting, and only use trusted Composer repositories as a workaround.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.91%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
+0.22 pp
From 1.69% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Affected systems
Chainguard1 product
- composer< 2.9.7-r0
Composer1 product
- composer≥ 2.3.0, < 2.9.6 | ≥ 1.0.0, < 2.2.27
Debian1 product
- composer< 2.5.5-1+deb12u4 | < 2.8.8-1+deb13u2 | < 2.9.7-1
Getcomposer1 product
- composer≥ 1.0.0, ≤ 2.2.26 | ≥ 2.3.0, ≤ 2.9.5
Ubuntu1 product
- composerAll versions (No fix recorded)
Wolfi1 product
- composer< 2.9.7-r0
6 vendors · 6 products
References
11 links- github.com/composer/composer/security/advisories/GHSA-gqw4-4w2p-838qX Refsource CONFIRMREPORTAdvisoryVendor Advisory
