{"affected":[{"product":"composer","source":"CNA: GitHub_M","vendor":"composer","versions":[{"status":"affected","version":">= 2.3, < 2.9.6"},{"status":"affected","version":">= 1.0, < 2.2.27"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"composer-main","product":"Red Hat Hardened Images","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.9.7-1.hum1","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"Packagist","packageName":"composer/composer","product":"composer/composer","source":"OSV GHSA-wg36-wvj6-r67p","vendor":"","versions":[{"status":"affected","version":"2.3.0","versionType":"Packagist"},{"status":"affected","version":"2.3.1","versionType":"Packagist"},{"status":"affected","version":"2.3.10","versionType":"Packagist"},{"status":"affected","version":"2.3.2","versionType":"Packagist"},{"status":"affected","version":"2.3.3","versionType":"Packagist"},{"status":"affected","version":"2.3.4","versionType":"Packagist"},{"status":"affected","version":"2.3.5","versionType":"Packagist"},{"status":"affected","version":"2.3.6","versionType":"Packagist"},{"status":"affected","version":"2.3.7","versionType":"Packagist"},{"status":"affected","version":"2.3.8","versionType":"Packagist"},{"status":"affected","version":"2.3.9","versionType":"Packagist"},{"status":"affected","version":"2.4.0","versionType":"Packagist"},{"status":"affected","version":"2.4.0-RC1","versionType":"Packagist"},{"status":"affected","version":"2.4.1","versionType":"Packagist"},{"status":"affected","version":"2.4.2","versionType":"Packagist"},{"status":"affected","version":"2.4.3","versionType":"Packagist"},{"status":"affected","version":"2.4.4","versionType":"Packagist"},{"status":"affected","version":"2.5.0","versionType":"Packagist"},{"status":"affected","version":"2.5.1","versionType":"Packagist"},{"status":"affected","version":"2.5.2","versionType":"Packagist"},{"status":"affected","version":"2.5.3","versionType":"Packagist"},{"status":"affected","version":"2.5.4","versionType":"Packagist"},{"status":"affected","version":"2.5.5","versionType":"Packagist"},{"status":"affected","version":"2.5.6","versionType":"Packagist"},{"status":"affected","version":"2.5.7","versionType":"Packagist"},{"status":"affected","version":"2.5.8","versionType":"Packagist"},{"status":"affected","version":"2.6.0","versionType":"Packagist"},{"status":"affected","version":"2.6.1","versionType":"Packagist"},{"status":"affected","version":"2.6.2","versionType":"Packagist"},{"status":"affected","version":"2.6.3","versionType":"Packagist"},{"status":"affected","version":"2.6.4","versionType":"Packagist"},{"status":"affected","version":"2.6.5","versionType":"Packagist"},{"status":"affected","version":"2.6.6","versionType":"Packagist"},{"status":"affected","version":"2.7.0","versionType":"Packagist"},{"status":"affected","version":"2.7.1","versionType":"Packagist"},{"status":"affected","version":"2.7.2","versionType":"Packagist"},{"status":"affected","version":"2.7.3","versionType":"Packagist"},{"status":"affected","version":"2.7.4","versionType":"Packagist"},{"status":"affected","version":"2.7.5","versionType":"Packagist"},{"status":"affected","version":"2.7.6","versionType":"Packagist"},{"status":"affected","version":"2.7.7","versionType":"Packagist"},{"status":"affected","version":"2.7.8","versionType":"Packagist"},{"status":"affected","version":"2.7.9","versionType":"Packagist"},{"status":"affected","version":"2.8.0","versionType":"Packagist"},{"status":"affected","version":"2.8.1","versionType":"Packagist"},{"status":"affected","version":"2.8.10","versionType":"Packagist"},{"status":"affected","version":"2.8.11","versionType":"Packagist"},{"status":"affected","version":"2.8.12","versionType":"Packagist"},{"status":"affected","version":"2.8.2","versionType":"Packagist"},{"status":"affected","version":"2.8.3","versionType":"Packagist"},{"status":"affected","version":"2.8.4","versionType":"Packagist"},{"status":"affected","version":"2.8.5","versionType":"Packagist"},{"status":"affected","version":"2.8.6","versionType":"Packagist"},{"status":"affected","version":"2.8.7","versionType":"Packagist"},{"status":"affected","version":"2.8.8","versionType":"Packagist"},{"status":"affected","version":"2.8.9","versionType":"Packagist"},{"status":"affected","version":"2.9.0","versionType":"Packagist"},{"status":"affected","version":"2.9.0-RC1","versionType":"Packagist"},{"status":"affected","version":"2.9.1","versionType":"Packagist"},{"status":"affected","version":"2.9.2","versionType":"Packagist"},{"status":"affected","version":"2.9.3","versionType":"Packagist"},{"status":"affected","version":"2.9.4","versionType":"Packagist"},{"status":"affected","version":"2.9.5","versionType":"Packagist"},{"events":[{"introduced":"2.3.0"},{"fixed":"2.9.6"}],"status":"unknown","version":"2.3.0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"Packagist","packageName":"composer/composer","product":"composer/composer","source":"OSV GHSA-wg36-wvj6-r67p","vendor":"","versions":[{"status":"affected","version":"1.0.0","versionType":"Packagist"},{"status":"affected","version":"1.0.1","versionType":"Packagist"},{"status":"affected","version":"1.0.2","versionType":"Packagist"},{"status":"affected","version":"1.0.3","versionType":"Packagist"},{"status":"affected","version":"1.1.0","versionType":"Packagist"},{"status":"affected","version":"1.1.0-RC","versionType":"Packagist"},{"status":"affected","version":"1.1.1","versionType":"Packagist"},{"status":"affected","version":"1.1.2","versionType":"Packagist"},{"status":"affected","version":"1.1.3","versionType":"Packagist"},{"status":"affected","version":"1.10.0","versionType":"Packagist"},{"status":"affected","version":"1.10.0-RC","versionType":"Packagist"},{"status":"affected","version":"1.10.1","versionType":"Packagist"},{"status":"affected","version":"1.10.10","versionType":"Packagist"},{"status":"affected","version":"1.10.11","versionType":"Packagist"},{"status":"affected","version":"1.10.12","versionType":"Packagist"},{"status":"affected","version":"1.10.13","versionType":"Packagist"},{"status":"affected","version":"1.10.14","versionType":"Packagist"},{"status":"affected","version":"1.10.15","versionType":"Packagist"},{"status":"affected","version":"1.10.16","versionType":"Packagist"},{"status":"affected","version":"1.10.17","versionType":"Packagist"},{"status":"affected","version":"1.10.18","versionType":"Packagist"},{"status":"affected","version":"1.10.19","versionType":"Packagist"},{"status":"affected","version":"1.10.2","versionType":"Packagist"},{"status":"affected","version":"1.10.20","versionType":"Packagist"},{"status":"affected","version":"1.10.21","versionType":"Packagist"},{"status":"affected","version":"1.10.22","versionType":"Packagist"},{"status":"affected","version":"1.10.23","versionType":"Packagist"},{"status":"affected","version":"1.10.24","versionType":"Packagist"},{"status":"affected","version":"1.10.25","versionType":"Packagist"},{"status":"affected","version":"1.10.26","versionType":"Packagist"},{"status":"affected","version":"1.10.27","versionType":"Packagist"},{"status":"affected","version":"1.10.28","versionType":"Packagist"},{"status":"affected","version":"1.10.3","versionType":"Packagist"},{"status":"affected","version":"1.10.4","versionType":"Packagist"},{"status":"affected","version":"1.10.5","versionType":"Packagist"},{"status":"affected","version":"1.10.6","versionType":"Packagist"},{"status":"affected","version":"1.10.7","versionType":"Packagist"},{"status":"affected","version":"1.10.8","versionType":"Packagist"},{"status":"affected","version":"1.10.9","versionType":"Packagist"},{"status":"affected","version":"1.2.0","versionType":"Packagist"},{"status":"affected","version":"1.2.0-RC","versionType":"Packagist"},{"status":"affected","version":"1.2.1","versionType":"Packagist"},{"status":"affected","version":"1.2.2","versionType":"Packagist"},{"status":"affected","version":"1.2.3","versionType":"Packagist"},{"status":"affected","version":"1.2.4","versionType":"Packagist"},{"status":"affected","version":"1.3.0","versionType":"Packagist"},{"status":"affected","version":"1.3.0-RC","versionType":"Packagist"},{"status":"affected","version":"1.3.1","versionType":"Packagist"},{"status":"affected","version":"1.3.2","versionType":"Packagist"},{"status":"affected","version":"1.3.3","versionType":"Packagist"},{"status":"affected","version":"1.4.0","versionType":"Packagist"},{"status":"affected","version":"1.4.1","versionType":"Packagist"},{"status":"affected","version":"1.4.2","versionType":"Packagist"},{"status":"affected","version":"1.4.3","versionType":"Packagist"},{"status":"affected","version":"1.5.0","versionType":"Packagist"},{"status":"affected","version":"1.5.1","versionType":"Packagist"},{"status":"affected","version":"1.5.2","versionType":"Packagist"},{"status":"affected","version":"1.5.3","versionType":"Packagist"},{"status":"affected","version":"1.5.4","versionType":"Packagist"},{"status":"affected","version":"1.5.5","versionType":"Packagist"},{"status":"affected","version":"1.5.6","versionType":"Packagist"},{"status":"affected","version":"1.6.0","versionType":"Packagist"},{"status":"affected","version":"1.6.0-RC","versionType":"Packagist"},{"status":"affected","version":"1.6.1","versionType":"Packagist"},{"status":"affected","version":"1.6.2","versionType":"Packagist"},{"status":"affected","version":"1.6.3","versionType":"Packagist"},{"status":"affected","version":"1.6.4","versionType":"Packagist"},{"status":"affected","version":"1.6.5","versionType":"Packagist"},{"status":"affected","version":"1.7.0","versionType":"Packagist"},{"status":"affected","version":"1.7.0-RC","versionType":"Packagist"},{"status":"affected","version":"1.7.1","versionType":"Packagist"},{"status":"affected","version":"1.7.2","versionType":"Packagist"},{"status":"affected","version":"1.7.3","versionType":"Packagist"},{"status":"affected","version":"1.8.0","versionType":"Packagist"},{"status":"affected","version":"1.8.1","versionType":"Packagist"},{"status":"affected","version":"1.8.2","versionType":"Packagist"},{"status":"affected","version":"1.8.3","versionType":"Packagist"},{"status":"affected","version":"1.8.4","versionType":"Packagist"},{"status":"affected","version":"1.8.5","versionType":"Packagist"},{"status":"affected","version":"1.8.6","versionType":"Packagist"},{"status":"affected","version":"1.9.0","versionType":"Packagist"},{"status":"affected","version":"1.9.1","versionType":"Packagist"},{"status":"affected","version":"1.9.2","versionType":"Packagist"},{"status":"affected","version":"1.9.3","versionType":"Packagist"},{"status":"affected","version":"2.0.0","versionType":"Packagist"},{"status":"affected","version":"2.0.0-RC1","versionType":"Packagist"},{"status":"affected","version":"2.0.0-RC2","versionType":"Packagist"},{"status":"affected","version":"2.0.0-alpha1","versionType":"Packagist"},{"status":"affected","version":"2.0.0-alpha2","versionType":"Packagist"},{"status":"affected","version":"2.0.0-alpha3","versionType":"Packagist"},{"status":"affected","version":"2.0.1","versionType":"Packagist"},{"status":"affected","version":"2.0.10","versionType":"Packagist"},{"status":"affected","version":"2.0.11","versionType":"Packagist"},{"status":"affected","version":"2.0.12","versionType":"Packagist"},{"status":"affected","version":"2.0.13","versionType":"Packagist"},{"status":"affected","version":"2.0.14","versionType":"Packagist"},{"status":"affected","version":"2.0.2","versionType":"Packagist"},{"status":"affected","version":"2.0.3","versionType":"Packagist"},{"status":"affected","version":"2.0.4","versionType":"Packagist"},{"status":"affected","version":"2.0.5","versionType":"Packagist"},{"status":"affected","version":"2.0.6","versionType":"Packagist"},{"status":"affected","version":"2.0.7","versionType":"Packagist"},{"status":"affected","version":"2.0.8","versionType":"Packagist"},{"status":"affected","version":"2.0.9","versionType":"Packagist"},{"status":"affected","version":"2.1.0","versionType":"Packagist"},{"status":"affected","version":"2.1.0-RC1","versionType":"Packagist"},{"status":"affected","version":"2.1.1","versionType":"Packagist"},{"status":"affected","version":"2.1.10","versionType":"Packagist"},{"status":"affected","version":"2.1.11","versionType":"Packagist"},{"status":"affected","version":"2.1.12","versionType":"Packagist"},{"status":"affected","version":"2.1.14","versionType":"Packagist"},{"status":"affected","version":"2.1.2","versionType":"Packagist"},{"status":"affected","version":"2.1.3","versionType":"Packagist"},{"status":"affected","version":"2.1.4","versionType":"Packagist"},{"status":"affected","version":"2.1.5","versionType":"Packagist"},{"status":"affected","version":"2.1.6","versionType":"Packagist"},{"status":"affected","version":"2.1.7","versionType":"Packagist"},{"status":"affected","version":"2.1.8","versionType":"Packagist"},{"status":"affected","version":"2.1.9","versionType":"Packagist"},{"status":"affected","version":"2.2.0","versionType":"Packagist"},{"status":"affected","version":"2.2.0-RC1","versionType":"Packagist"},{"status":"affected","version":"2.2.1","versionType":"Packagist"},{"status":"affected","version":"2.2.10","versionType":"Packagist"},{"status":"affected","version":"2.2.11","versionType":"Packagist"},{"status":"affected","version":"2.2.12","versionType":"Packagist"},{"status":"affected","version":"2.2.13","versionType":"Packagist"},{"status":"affected","version":"2.2.14","versionType":"Packagist"},{"status":"affected","version":"2.2.15","versionType":"Packagist"},{"status":"affected","version":"2.2.16","versionType":"Packagist"},{"status":"affected","version":"2.2.17","versionType":"Packagist"},{"status":"affected","version":"2.2.18","versionType":"Packagist"},{"status":"affected","version":"2.2.19","versionType":"Packagist"},{"status":"affected","version":"2.2.2","versionType":"Packagist"},{"status":"affected","version":"2.2.20","versionType":"Packagist"},{"status":"affected","version":"2.2.21","versionType":"Packagist"},{"status":"affected","version":"2.2.22","versionType":"Packagist"},{"status":"affected","version":"2.2.23","versionType":"Packagist"},{"status":"affected","version":"2.2.24","versionType":"Packagist"},{"status":"affected","version":"2.2.25","versionType":"Packagist"},{"status":"affected","version":"2.2.26","versionType":"Packagist"},{"status":"affected","version":"2.2.3","versionType":"Packagist"},{"status":"affected","version":"2.2.4","versionType":"Packagist"},{"status":"affected","version":"2.2.5","versionType":"Packagist"},{"status":"affected","version":"2.2.6","versionType":"Packagist"},{"status":"affected","version":"2.2.7","versionType":"Packagist"},{"status":"affected","version":"2.2.8","versionType":"Packagist"},{"status":"affected","version":"2.2.9","versionType":"Packagist"},{"events":[{"introduced":"1.0.0"},{"fixed":"2.2.27"}],"status":"unknown","version":"1.0.0","versionType":"ECOSYSTEM"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.26","versionStartIncluding":"1.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*","versionEndIncluding":"2.9.5","versionStartIncluding":"2.3.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-40176","cwes":["CWE-20","CWE-78"],"description":"Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).","epss":{"date":"2026-11-02","percentile":0.6415,"score":0.01045},"exploits":[],"kev":null,"metrics":[{"score":7.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.8,"severity":"high","source":"ADP: redhat-SADP","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.8,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.8,"severity":"high","source":"NVD: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793661440667,"publishedAt":1776286059839,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://access.redhat.com/errata/RHSA-2026:8165"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://access.redhat.com/security/cve/CVE-2026-40176"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458828"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40176.yaml"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/composer/composer/releases/tag/2.2.27"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/composer/composer/releases/tag/2.9.6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json"},{"source":"ADP: redhat-SADP","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-40176"},{"source":"ADP: redhat-SADP","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458828"},{"source":"ADP: redhat-SADP","tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:8165"},{"source":"security-advisories@github.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:8165"},{"source":"security-advisories@github.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-40176"},{"source":"security-advisories@github.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458828"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40176.yaml"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/composer/composer/releases/tag/2.2.27"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/composer/composer/releases/tag/2.9.6"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p"},{"source":"security-advisories@github.com","tags":[],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:8165"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-40176"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458828"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-wg36-wvj6-r67p"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-wg36-wvj6-r67p"}],"remediation":[{"kind":"fix","source":"ADP: redhat-SADP","text":"RHSA-2026:8165: Red Hat Hardened Images"},{"kind":"workaround","source":"ADP: redhat-SADP","text":"To mitigate this vulnerability, only run Composer commands on projects from trusted sources. Also, inspect composer.json files before running Composer commands on them, specifically checking that Perforce-related fields contain valid values."},{"kind":"fix","source":"OSV GHSA-wg36-wvj6-r67p","text":"composer/composer (Packagist): OSV reports a fixed version 2.9.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-wg36-wvj6-r67p"},{"kind":"fix","source":"OSV GHSA-wg36-wvj6-r67p","text":"composer/composer (Packagist): OSV reports a fixed version 2.2.27. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-wg36-wvj6-r67p"}],"revision":"283d8d63dc506efa8b54d5fb15e0e4139a454959c873a1b9d7b4777ddffd8253","sources":[{"modifiedAt":1793660672552,"name":"CNA: GitHub_M","retrievedAt":1793664502181,"url":"https://www.cve.org/CVERecord?id=CVE-2026-40176"},{"modifiedAt":1793661440667,"name":"NVD","retrievedAt":1793665133587,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40176"},{"modifiedAt":1793661303623,"name":"OSV / GitHub Security Advisories","retrievedAt":1793664505283,"url":"https://osv.dev/vulnerability/GHSA-wg36-wvj6-r67p"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793668119969,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-40176"}],"ssvc":{"assessedAt":1776348961309,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Composer is vulnerable to Command Injection via Malicious Perforce Repository","updatedAt":1793668119969}