# CVE-2026-40176: Composer is vulnerable to Command Injection via Malicious Perforce Repository

Status: published. Published: 2026-04-15. Updated: 2026-11-02.

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).

## Remediation

- fix: RHSA-2026:8165: Red Hat Hardened Images (source: ADP: redhat-SADP)
- workaround: To mitigate this vulnerability, only run Composer commands on projects from trusted sources. Also, inspect composer.json files before running Composer commands on them, specifically checking that Perforce-related fields contain valid values. (source: ADP: redhat-SADP)
- fix: composer/composer (Packagist): OSV reports a fixed version 2.9.6. Check the advisory for supported release branches. (source: OSV GHSA-wg36-wvj6-r67p) — https://github.com/advisories/GHSA-wg36-wvj6-r67p
- fix: composer/composer (Packagist): OSV reports a fixed version 2.2.27. Check the advisory for supported release branches. (source: OSV GHSA-wg36-wvj6-r67p) — https://github.com/advisories/GHSA-wg36-wvj6-r67p

## Affected products and versions

- composer / composer: >= 2.3, < 2.9.6 (affected); >= 1.0, < 2.2.27 (affected). Source: CNA: GitHub_M
- Red Hat / Red Hat Hardened Images (composer-main): ≥ 2.9.7-1.hum1; < * (unaffected, rpm). Source: ADP: redhat-SADP
-  / composer/composer (composer/composer): 2.3.0 (affected, Packagist); 2.3.1 (affected, Packagist); 2.3.10 (affected, Packagist); 2.3.2 (affected, Packagist); 2.3.3 (affected, Packagist); 2.3.4 (affected, Packagist); 2.3.5 (affected, Packagist); 2.3.6 (affected, Packagist); 2.3.7 (affected, Packagist); 2.3.8 (affected, Packagist); 2.3.9 (affected, Packagist); 2.4.0 (affected, Packagist); 2.4.0-RC1 (affected, Packagist); 2.4.1 (affected, Packagist); 2.4.2 (affected, Packagist); 2.4.3 (affected, Packagist); 2.4.4 (affected, Packagist); 2.5.0 (affected, Packagist); 2.5.1 (affected, Packagist); 2.5.2 (affected, Packagist); 2.5.3 (affected, Packagist); 2.5.4 (affected, Packagist); 2.5.5 (affected, Packagist); 2.5.6 (affected, Packagist); 2.5.7 (affected, Packagist); 2.5.8 (affected, Packagist); 2.6.0 (affected, Packagist); 2.6.1 (affected, Packagist); 2.6.2 (affected, Packagist); 2.6.3 (affected, Packagist); 2.6.4 (affected, Packagist); 2.6.5 (affected, Packagist); 2.6.6 (affected, Packagist); 2.7.0 (affected, Packagist); 2.7.1 (affected, Packagist); 2.7.2 (affected, Packagist); 2.7.3 (affected, Packagist); 2.7.4 (affected, Packagist); 2.7.5 (affected, Packagist); 2.7.6 (affected, Packagist); 2.7.7 (affected, Packagist); 2.7.8 (affected, Packagist); 2.7.9 (affected, Packagist); 2.8.0 (affected, Packagist); 2.8.1 (affected, Packagist); 2.8.10 (affected, Packagist); 2.8.11 (affected, Packagist); 2.8.12 (affected, Packagist); 2.8.2 (affected, Packagist); 2.8.3 (affected, Packagist); 2.8.4 (affected, Packagist); 2.8.5 (affected, Packagist); 2.8.6 (affected, Packagist); 2.8.7 (affected, Packagist); 2.8.8 (affected, Packagist); 2.8.9 (affected, Packagist); 2.9.0 (affected, Packagist); 2.9.0-RC1 (affected, Packagist); 2.9.1 (affected, Packagist); 2.9.2 (affected, Packagist); 2.9.3 (affected, Packagist); 2.9.4 (affected, Packagist); 2.9.5 (affected, Packagist); Ecosystem version events: introduced 2.3.0; fixed 2.9.6. Source: OSV GHSA-wg36-wvj6-r67p
-  / composer/composer (composer/composer): 1.0.0 (affected, Packagist); 1.0.1 (affected, Packagist); 1.0.2 (affected, Packagist); 1.0.3 (affected, Packagist); 1.1.0 (affected, Packagist); 1.1.0-RC (affected, Packagist); 1.1.1 (affected, Packagist); 1.1.2 (affected, Packagist); 1.1.3 (affected, Packagist); 1.10.0 (affected, Packagist); 1.10.0-RC (affected, Packagist); 1.10.1 (affected, Packagist); 1.10.10 (affected, Packagist); 1.10.11 (affected, Packagist); 1.10.12 (affected, Packagist); 1.10.13 (affected, Packagist); 1.10.14 (affected, Packagist); 1.10.15 (affected, Packagist); 1.10.16 (affected, Packagist); 1.10.17 (affected, Packagist); 1.10.18 (affected, Packagist); 1.10.19 (affected, Packagist); 1.10.2 (affected, Packagist); 1.10.20 (affected, Packagist); 1.10.21 (affected, Packagist); 1.10.22 (affected, Packagist); 1.10.23 (affected, Packagist); 1.10.24 (affected, Packagist); 1.10.25 (affected, Packagist); 1.10.26 (affected, Packagist); 1.10.27 (affected, Packagist); 1.10.28 (affected, Packagist); 1.10.3 (affected, Packagist); 1.10.4 (affected, Packagist); 1.10.5 (affected, Packagist); 1.10.6 (affected, Packagist); 1.10.7 (affected, Packagist); 1.10.8 (affected, Packagist); 1.10.9 (affected, Packagist); 1.2.0 (affected, Packagist); 1.2.0-RC (affected, Packagist); 1.2.1 (affected, Packagist); 1.2.2 (affected, Packagist); 1.2.3 (affected, Packagist); 1.2.4 (affected, Packagist); 1.3.0 (affected, Packagist); 1.3.0-RC (affected, Packagist); 1.3.1 (affected, Packagist); 1.3.2 (affected, Packagist); 1.3.3 (affected, Packagist); 1.4.0 (affected, Packagist); 1.4.1 (affected, Packagist); 1.4.2 (affected, Packagist); 1.4.3 (affected, Packagist); 1.5.0 (affected, Packagist); 1.5.1 (affected, Packagist); 1.5.2 (affected, Packagist); 1.5.3 (affected, Packagist); 1.5.4 (affected, Packagist); 1.5.5 (affected, Packagist); 1.5.6 (affected, Packagist); 1.6.0 (affected, Packagist); 1.6.0-RC (affected, Packagist); 1.6.1 (affected, Packagist); 1.6.2 (affected, Packagist); 1.6.3 (affected, Packagist); 1.6.4 (affected, Packagist); 1.6.5 (affected, Packagist); 1.7.0 (affected, Packagist); 1.7.0-RC (affected, Packagist); 1.7.1 (affected, Packagist); 1.7.2 (affected, Packagist); 1.7.3 (affected, Packagist); 1.8.0 (affected, Packagist); 1.8.1 (affected, Packagist); 1.8.2 (affected, Packagist); 1.8.3 (affected, Packagist); 1.8.4 (affected, Packagist); 1.8.5 (affected, Packagist); 1.8.6 (affected, Packagist); 1.9.0 (affected, Packagist); 1.9.1 (affected, Packagist); 1.9.2 (affected, Packagist); 1.9.3 (affected, Packagist); 2.0.0 (affected, Packagist); 2.0.0-RC1 (affected, Packagist); 2.0.0-RC2 (affected, Packagist); 2.0.0-alpha1 (affected, Packagist); 2.0.0-alpha2 (affected, Packagist); 2.0.0-alpha3 (affected, Packagist); 2.0.1 (affected, Packagist); 2.0.10 (affected, Packagist); 2.0.11 (affected, Packagist); 2.0.12 (affected, Packagist); 2.0.13 (affected, Packagist); 2.0.14 (affected, Packagist); 2.0.2 (affected, Packagist); 2.0.3 (affected, Packagist); 2.0.4 (affected, Packagist); 2.0.5 (affected, Packagist); 2.0.6 (affected, Packagist); 2.0.7 (affected, Packagist); 2.0.8 (affected, Packagist); 2.0.9 (affected, Packagist); 2.1.0 (affected, Packagist); 2.1.0-RC1 (affected, Packagist); 2.1.1 (affected, Packagist); 2.1.10 (affected, Packagist); 2.1.11 (affected, Packagist); 2.1.12 (affected, Packagist); 2.1.14 (affected, Packagist); 2.1.2 (affected, Packagist); 2.1.3 (affected, Packagist); 2.1.4 (affected, Packagist); 2.1.5 (affected, Packagist); 2.1.6 (affected, Packagist); 2.1.7 (affected, Packagist); 2.1.8 (affected, Packagist); 2.1.9 (affected, Packagist); 2.2.0 (affected, Packagist); 2.2.0-RC1 (affected, Packagist); 2.2.1 (affected, Packagist); 2.2.10 (affected, Packagist); 2.2.11 (affected, Packagist); 2.2.12 (affected, Packagist); 2.2.13 (affected, Packagist); 2.2.14 (affected, Packagist); 2.2.15 (affected, Packagist); 2.2.16 (affected, Packagist); 2.2.17 (affected, Packagist); 2.2.18 (affected, Packagist); 2.2.19 (affected, Packagist); 2.2.2 (affected, Packagist); 2.2.20 (affected, Packagist); 2.2.21 (affected, Packagist); 2.2.22 (affected, Packagist); 2.2.23 (affected, Packagist); 2.2.24 (affected, Packagist); 2.2.25 (affected, Packagist); 2.2.26 (affected, Packagist); 2.2.3 (affected, Packagist); 2.2.4 (affected, Packagist); 2.2.5 (affected, Packagist); 2.2.6 (affected, Packagist); 2.2.7 (affected, Packagist); 2.2.8 (affected, Packagist); 2.2.9 (affected, Packagist); Ecosystem version events: introduced 1.0.0; fixed 2.2.27. Source: OSV GHSA-wg36-wvj6-r67p

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "2.2.26",
            "versionStartIncluding": "1.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "2.9.5",
            "versionStartIncluding": "2.3.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: CNA: GitHub_M

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: ADP: redhat-SADP

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: NVD: security-advisories@github.com

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; source: NVD: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

- CISA KEV: No listing in collected sources

- EPSS: 1.04% as of 2026-11-02; percentile 64.15%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-20, CWE-78

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p (CNA: GitHub_M; x_refsource_CONFIRM)

- https://access.redhat.com/errata/RHSA-2026:8165 (CNA: GitHub_M; x_refsource_MISC)

- https://access.redhat.com/security/cve/CVE-2026-40176 (CNA: GitHub_M; x_refsource_MISC)

- https://bugzilla.redhat.com/show_bug.cgi?id=2458828 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40176.yaml (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/composer/composer/releases/tag/2.2.27 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/composer/composer/releases/tag/2.9.6 (CNA: GitHub_M; x_refsource_MISC)

- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json (CNA: GitHub_M; x_refsource_MISC)

- https://access.redhat.com/security/cve/CVE-2026-40176 (ADP: redhat-SADP; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2458828 (ADP: redhat-SADP; issue-tracking, x_refsource_REDHAT)

- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json (ADP: redhat-SADP; x_sadp-csaf-vex)

- https://access.redhat.com/errata/RHSA-2026:8165 (ADP: redhat-SADP; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:8165 (security-advisories@github.com)

- https://access.redhat.com/security/cve/CVE-2026-40176 (security-advisories@github.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2458828 (security-advisories@github.com)

- https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40176.yaml (security-advisories@github.com)

- https://github.com/composer/composer/releases/tag/2.2.27 (security-advisories@github.com)

- https://github.com/composer/composer/releases/tag/2.9.6 (security-advisories@github.com; Release Notes)

- https://github.com/composer/composer/security/advisories/GHSA-wg36-wvj6-r67p (security-advisories@github.com; Vendor Advisory)

- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json (security-advisories@github.com)

- https://access.redhat.com/errata/RHSA-2026:8165 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)

- https://access.redhat.com/security/cve/CVE-2026-40176 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)

- https://bugzilla.redhat.com/show_bug.cgi?id=2458828 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)

- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40176.json (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)

- https://github.com/advisories/GHSA-wg36-wvj6-r67p (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-wg36-wvj6-r67p (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-40176; retrieved 2026-11-03; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-40176; retrieved 2026-11-03; source updated 2026-11-02

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-wg36-wvj6-r67p; retrieved 2026-11-03; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-40176; retrieved 2026-11-03; source updated Not reported

Revision: 283d8d63dc506efa8b54d5fb15e0e4139a454959c873a1b9d7b4777ddffd8253

Canonical: https://y2.dev/cve/CVE-2026-40176

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.