composer-CVE-2026-40261-CVE-2026-40176-PoC

!CAUTION ESTE REPOSITÓRIO CONTÉM CÓDIGO DE PROVA DE CONCEITO PARA AS VULNERABILIDADES CVE-2026-40261 E CVE-2026-40176 NO COMPOSER. !CAUTION O CÓDIGO DESTINA-SE APENAS A FINS EDUCACIONAIS E DE TESTE. !CAUTION NÃO USE ESTE CÓDIGO EM AMBIENTES DE PRODUÇÃO NEM CONTRA SISTEMAS SEM A DEVIDA AUTORIZAÇÃO...

Security update for php-composer2

This update for php-composer2 fixes the following issues CVE-2026-40176: command injection via malicious Perforce repository definition bsc1262254. CVE-2026-40261: command injection via malicious Perforce source reference/url bsc1262255. Changes for php-composer2: version update to 2.2.27 align...

CVE-2026-40261

A flaw was found in Composer. Perforce::syncCodeBase appends the $sourceReference parameter to a shell command without proper escaping, allowing an attacker to inject arbitrary commands through a crafted source reference containing shell metacharacters. Mitigation To mitigate this issue, only run...

Fedora 43 : composer (2026-02c1f66b6a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-02c1f66b6a advisory. Version 2.9.7 - 2026-04-14 Fixes regression calling custom script command aliases that are called a substring of a composer command 12802 ---- Versi...

CVE-2026-40261

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the...