CVE-2026-40176

OVERVIEW CVE-2026-40176 is a command injection vulnerability in Composer, a PHP dependency manager affecting versions 1.0 through 2.2.26 and 2.3 through 2.9.5. The flaw exists in the Perforce::generateP4Command() method, which fails to properly escape user-supplied Perforce connection parameters (port, user, client) when constructing shell commands. An attacker can inject arbitrary commands through a malicious composer.json file declaring a Perforce VCS repository, resulting in command execution under the privileges of the user running Composer, regardless of whether Perforce is actually installed on the system. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low attack complexity, no privilege requirements, and user interaction needed. The impact is severe, allowing an attacker to achieve complete compromise through high confidentiality, integrity, and availability impacts. The attack requires the victim to run Composer commands on an untrusted project, which represents a realistic scenario for developers working with shared or downloaded codebases. Exploitation is restricted to VCS repositories declared in root composer.json files or the composer config directory, preventing exploitation through transitive dependencies. EXPLOITATION STATUS There is no indication of active exploitation in the wild. The EPSS score of 0.00011 indicates very low probability of exploitation, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is currently available, and community attention remains minimal as reflected by the inactive status on relevant tracking lists. Users should prioritize patching by updating to Composer 2.2.27 (LTS) or 2.9.6 (mainline) to remediate this risk.