CVE-2026-84361

Composer (PHP dependency manager) versions 1.0 through 2.2.30 and 2.10.3 are affected by a vulnerability in Composer\Util\Perforce . A malicious dependency package from a custom Composer repository or untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh:...