New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released

2026-04-15

Two command injection vulnerabilities (CVE-2026-40176, CVE-2026-40261) have been discovered in Composer's Perforce VCS driver. These flaws enable arbitrary command execution through malicious `composer.json` configurations or crafted source references, even if Perforce is not installed. Patches have been released to address these issues.