composer-CVE-2026-40261-CVE-2026-40176-PoC

!CAUTION 本仓库包含针对 Composer 中漏洞 CVE-2026-40261 和 CVE-2026-40176 的概念验证代码。 !CAUTION 该代码仅用于教育和测试目的。 !CAUTION 请勿在生产环境中使用此代码，或未经适当授权对系统进行测试。 !CAUTION 在测试任何安全漏洞之前，请务必确保您已获得许可。 概述 本仓库演示了 Composer 中通过 Perforce VCS 驱动程序进行命令注入的两个漏洞。 共有三种攻击向量： 1. 向量 1 — 通过 'url' 注入（变为 -p ）。旧代码在构造 Perforce 驱动程序的命令字符串时未对 URL...

Security update for php-composer2

This update for php-composer2 fixes the following issues CVE-2026-40176: command injection via malicious Perforce repository definition bsc1262254. CVE-2026-40261: command injection via malicious Perforce source reference/url bsc1262255. Changes for php-composer2: version update to 2.2.27 align...

CVE-2026-40261

A flaw was found in Composer. Perforce::syncCodeBase appends the $sourceReference parameter to a shell command without proper escaping, allowing an attacker to inject arbitrary commands through a crafted source reference containing shell metacharacters. Mitigation To mitigate this issue, only run...

Fedora 43 : composer (2026-02c1f66b6a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-02c1f66b6a advisory. Version 2.9.7 - 2026-04-14 Fixes regression calling custom script command aliases that are called a substring of a composer command 12802 ---- Versi...

CVE-2026-40261

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the...