PT-2026-32622 · Packagist · Composer/Composer

Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-40261

X.com · Thehackersnews

CVSS v3.1

8.8

High

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

⚠️ ALERT - Composer disclosed two command injection flaws (CVE-2026-40176 and CVE-2026-40261) with up to CVSS 8.8 severity.

Malicious composer.json or crafted source refs can execute arbitrary commands—even without Perforce installed.

🔗 Read → https://t.co/FN4x7pIEMY

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40261

GHSA-GQW4-4W2P-838Q

Affected Products

Composer/Composer

References · 12

• https://osv.dev/vulnerability/GHSA-gqw4-4w2p-838q · Vendor Advisory
• https://github.com/composer/composer · Note
• https://twitter.com/Archange_Shadow/status/2044098991344717841 · Twitter Post
• https://twitter.com/TheHackersNews/status/2044082880171913709 · Twitter Post
• https://blog.packagist.com/composer-2-9-6-perforce-driver-command-injection-vulnerabilities · Reddit Post
• https://twitter.com/SecureChap/status/2044145492104212897 · Twitter Post
• https://github.com/composer/composer/security/advisories/GHSA-gqw4-4w2p-838q · Note
• https://twitter.com/the_yellow_fall/status/2044003670463754663 · Twitter Post
• https://twitter.com/cyberkendra/status/2044073421425004684 · Twitter Post
• https://twitter.com/packagist/status/2043994349579473289 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2044139905387725255 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2044195750716797111 · Twitter Post