terminat0r7031/composer-cve-2026-40261-cve-2026-40176-pocProof-of-concept demonstrating command injection vulnerabilities in Composer's Perforce driver, with two attack vectors and Docker-based testing.
[!CAUTION] THIS REPOSITORY CONTAINS PROOF-OF-CONCEPT CODE FOR VULNERABILITIES CVE-2026-40261 AND CVE-2026-40176 IN COMPOSER.
[!CAUTION] THE CODE IS INTENDED FOR EDUCATIONAL AND TESTING PURPOSES ONLY.
[!CAUTION] DO NOT USE THIS CODE IN PRODUCTION ENVIRONMENTS OR AGAINST SYSTEMS WITHOUT PROPER AUTHORIZATION.
[!CAUTION] ALWAYS ENSURE YOU HAVE PERMISSION BEFORE TESTING ANY SECURITY VULNERABILITIES.
This repository demonstrates two vulnerabilities in Composer related to command injection via the Perforce VCS driver.
There are three vectors of attack:
The composer.json.vector1 and composer.json.vector2 files contain the payloads for each of the two vectors. Each payload is designed to execute a command that creates a file in the /tmp directory, demonstrating successful command injection.
To test the vulnerabilities, you can use the following steps. Make sure you have Docker installed on your system to run the Composer container.
composer.json file.For example, to test VECTOR 1, copy composer.json.vector1 to composer.json by running:
cp composer.json.vector1 composer.json
For example, using composer version 2.9.3 (which is vulnerable to both CVE-2026-40261 and CVE-2026-40176):
docker container run --rm --platform linux/amd64 -v ./:/app -it composer:2.9.3 bash
ls -l /tmp/
Expect to see that the file created by the command injection (e.g., pwned_via_url, or pwned_via_user) is not present.
composer install --prefer-dist
ls -l /tmp/
Expect to see the file created by the command injection (e.g., pwned_via_url or pwned_via_user) is now present, indicating that the command injection was successful.
