← Vulnerability feed

Vulnerability record · CVE-2026-40176 · published 15 April 2026

CVE-2026-40176: Getcomposer composer improper input validation vulnerability

Getcomposer · Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).

7.8 CVSS 3.1 High EPSS 1.00% · top 38.7% CWE-20 · Improper input validationCWE-78 · OS command injection
7.8CVSS 3.1 base score
1.00%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
15 Jul 2026Last modified by NVD

Description

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/composer/composer/releases/tag/2.9.6 Release Notes
https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:8165
https://access.redhat.com/security/cve/CVE-2026-40176
https://bugzilla.redhat.com/show_bug.cgi?id=2458828
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json

Track CVE-2026-40176 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-41116Getcomposer composer command injection vulnerabilityComposer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependen…EPSS 2.9%8.8CVE-2026-40261Getcomposer composer improper input validation vulnerabilityComposer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce…EPSS 1.9%8.8CVE-2023-43655Getcomposer composer injection vulnerabilityComposer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed …EPSS 1.4%8.8CVE-2015-8371Getcomposer composer insufficient verification of data authenticity vulnerabilityComposer before 2016-02-10 allows cache poisoning from other projects built on the same host. This results in attacker-controlled code entering a ser…EPSS 0.70%8.8CVE-2022-24828Getcomposer composer improper input validation vulnerabilityComposer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a cod…EPSS 1.9%8.8CVE-2021-29472Getcomposer composer argument injection vulnerabilityComposer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitize…EPSS 4.6%7.8CVE-2024-24821Getcomposer composer inclusion from untrusted sphere vulnerabilityComposer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the …EPSS 0.28%1.3CVE-2025-67746Getcomposer composer injection vulnerabilityComposer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer…EPSS 0.45%

Source: NIST National Vulnerability Database (record CVE-2026-40176), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.