CVE-2026-40261

OVERVIEW CVE-2026-40261 is a command injection vulnerability in Composer, a widely-used PHP dependency manager. Affected versions include Composer 1.0 through 2.2.26 and 2.3 through 2.9.5. The vulnerability exists in the Perforce version control integration, where the syncCodeBase() and generateP4Command() methods fail to properly escape user-supplied parameters including source references and Perforce connection details (port, user, client). An attacker can inject arbitrary shell commands through crafted package metadata, even if Perforce is not installed on the target system. SEVERITY The vulnerability carries a CVSS score of 8.8 (HIGH) with a network attack vector, low attack complexity, and no privilege requirements. The critical aspect is that user interaction is required—developers must install or update dependencies from source. The attack has high impact across confidentiality, integrity, and availability. Any compromised or malicious Composer repository can serve malicious package metadata, making this particularly dangerous in supply chain scenarios where developers may unknowingly pull from untrusted sources. EXPLOITATION STATUS There is no indication of active exploitation in the wild. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog and is inactive on threat intelligence hot lists. The EPSS score of 0.0004 suggests minimal real-world exploitation probability. However, given the supply chain attack vector and relative ease of exploitation, organizations should treat this as a medium-priority remediation. Composer versions 2.2.27 (LTS) and 2.9.6 (mainline) contain fixes; developers unable to update immediately should use the --prefer-dist flag to install pre-built distributions instead of building from source.