Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-84361, a vulnerability affecting Composer, has been published. https://saku0512.com/cve/cve-2026-84361 Thanks to the @packagist team for coordinating the disclosure and fix.
Post summary
CVE-2026-84361, affecting Composer, has been publicly disclosed and a fix has been coordinated by Packagist, with no PoC, exploit, or active exploitation reported.
🔴 Composer, Remote Code Execution (RCE), #CVE-2026-84361 (High) -DC-Sep2026-2283 https://dailycve.com/composer-remote-code-execution-rce-cve-2026-84361-high-dc-sep2026-2283/
Post summary
The post announces CVE-2026-84361 as a high-severity Remote Code Execution vulnerability affecting Composer, without providing PoC, exploit, or patch details.