PT-2026-84464
CVE-2026-84361
·
تاريخ النشر
2026-08-27
·
تاريخ التحديث
2026-09-22
الوصف من
CVSS 4.0
7.7
عاليةالمقاييسAV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Composer versions 1.0 through 2.2.29
Composer versions 2.10.0 through 2.10.2
Description
Composer, a dependency manager for PHP, fails to validate the
source.url when source.type is set to perforce. A malicious package from a custom repository or an untrusted composer.lock file can specify an rsh: or jsh: P4PORT value. If the Perforce p4 client is installed, executing composer install or composer update (including the --prefer-source flag) causes the ComposerUtilPerforce function to pass the unvalidated address to p4, leading to the execution of local commands with the privileges of the user or CI account.Recommendations
Update to version 2.2.30 or later.
Update to version 2.10.3 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾