CVE-2026-40176
HIGHComposer is vulnerable to Command Injection via Malicious Perforce Repository
Title source: cnaExploitation Summary
EIP tracks 4 public exploits for CVE-2026-40176. PoCs published by adminlove520, terminat0r7031, Saku0512.
AI-analyzed exploit summary This repository contains a functional Proof of Concept (PoC) for CVE-2026-40176, an OS Command Injection vulnerability in Composer's Perforce VCS driver. The PoC demonstrates how attacker-controlled input in the `composer.json` file can lead to arbitrary command execution via insufficient sanitization in the `generateP4Command()` method.
Description
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json declaring a Perforce VCS repository, leading to command execution in the context of the user running Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json or the composer config directory, so this cannot be exploited through composer.json files of packages installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline).
Exploits (4)
This repository contains a functional Proof of Concept (PoC) for CVE-2026-40176, an OS Command Injection vulnerability in Composer's Perforce VCS driver. The PoC demonstrates how attacker-controlled input in the `composer.json` file can lead to arbitrary command execution via insufficient sanitization in the `generateP4Command()` method.
This repository contains a functional proof-of-concept exploit for CVE-2026-40176 and CVE-2026-40261, demonstrating command injection vulnerabilities in Composer's Perforce VCS driver via unsanitized 'url' and 'p4user' parameters.
This repository contains a functional proof-of-concept exploit for CVE-2026-40176, demonstrating an OS command injection vulnerability in Composer's Perforce VCS driver. The PoC reproduces the vulnerable command generation logic and executes a malicious payload to confirm RCE.
The repository contains a functional proof-of-concept for CVE-2026-40176, demonstrating a command injection vulnerability in Composer's Perforce repository driver. The exploit leverages insufficient input validation in repository URL processing to achieve remote code execution.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H