CVE-2026-84361 composer CVE debrief

Who should care

Organizations and developers using Composer for dependency management in PHP projects should be aware of this vulnerability and take steps to mitigate it. This includes updating to versions 2.2.30 or 2.10.3, reviewing and validating composer.lock files from untrusted sources, and monitoring for suspicious activity in Composer installations. Security teams and vulnerability management teams should prioritize this vulnerability due to its potential impact on PHP projects using Composer for dependency management.

Technical summary

Composer, a dependency manager for PHP, is vulnerable to a malicious dependency package that could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When installed and executed, this could lead to local command execution with the privileges of the user or CI account running Composer. The issue is fixed in versions 2.2.30 and 2.10.3. Users should update to these versions or apply mitigations to prevent exploitation.

Defensive priority

Organizations using Composer should prioritize updating to versions 2.2.30 or 2.10.3 to mitigate this vulnerability.

Recommended defensive actions

• Update Composer to version 2.2.30 or 2.10.3
• Review and validate composer.lock files from untrusted sources
• Monitor for suspicious activity in Composer installations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record indicates that Composer, a dependency manager for PHP, is vulnerable to a malicious dependency package that could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value, potentially leading to local command execution with user or CI account privileges. This issue is compounded by the fact that Packagist.org does not permit Perforce source metadata, limiting visibility into affected systems. Defenders should verify Composer installations, review composer.lock files from untrusted sources, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.