Loading vulnerability…
CVE-2026-40261 is a command injection vulnerability in Composer's Perforce VCS driver. Affected versions are Composer 1.0 through 2.2.26 and 2.3 through 2.9.5. The flaw is centered on the Perforce::syncCodeBase() method, which appends the attacker-controlled $sourceReference value to a shell command without proper escaping. The issue is compounded by unsafe command construction in Perforce::generateP4Command(), similar to CVE-2026-40176, where Perforce connection parameters derived from the source URL may also be interpolated into shell commands without sufficient escaping. Unlike CVE-2026-40176, this vulnerability is delivered through package metadata from a malicious or compromised Composer repository: an attacker can publish or serve metadata declaring a Perforce source type and embed shell metacharacters in the source reference or source URL fields. When Composer installs or updates dependencies from source, the crafted metadata can cause arbitrary shell commands to be executed on the client system, even if Perforce itself is not installed.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Small PoC repository for an alleged Composer Perforce repository command-injection vulnerability identified as CVE-2026-40176. The repository contains only two files: a README describing the issue and reproduction steps, and a crafted composer.json that acts as the exploit artifact. There is no standalone exploit program; the exploit is triggered by running vulnerable Composer against the malicious project configuration. Core capability: the composer.json defines a repository of type 'perforce' with attacker-controlled fields. The p4user field contains the payload 'user; touch ./pwned #', intended to break out of the generated shell command and execute an arbitrary local shell command. If Composer versions prior to 2.2.27 construct Perforce CLI commands without proper escaping, running 'composer install' or 'composer update' would execute the injected command. Repository structure and purpose: README.md documents the claimed vulnerability, affected versions, vulnerable code pattern, and mitigation guidance. composer.json is the actual PoC configuration and the main entry point. The README mentions additional files (vuln-composer.phar and patched-composer.phar), but they are not present in the analyzed repository snapshot, so the repo is incomplete relative to its documentation. Notable findings: the PoC targets the local machine executing Composer rather than a remote network service directly; the attack vector is best characterized as supply-chain/configuration-driven leading to local command execution during dependency resolution. The included endpoint 'localhost:8080' is the configured Perforce server target. There is a documentation inconsistency: the README says exploitation should create '/tmp/pwned', while the actual payload in composer.json creates './pwned'. Overall, this is a plausible operational PoC configuration rather than a full exploit toolkit.
This repository is a small proof-of-concept set for command injection in Composer's Perforce VCS driver. It contains one README and three JSON files: a default composer.json plus two variant PoCs, composer.json.vector1 and composer.json.vector2. The exploit is not part of a larger framework. The core capability is arbitrary shell command execution when Composer parses a crafted perforce repository definition during operations such as 'composer install --prefer-dist'. The repository demonstrates two concrete injection vectors: (1) the perforce repository 'url' field, which is interpreted as the Perforce server/port argument and is populated with 'localhost:1666; touch /tmp/pwned_via_port'; and (2) the 'p4user' field, populated with 'user; touch /tmp/pwned_via_user #'. In both cases, shell metacharacters break out of the intended argument context and append a shell command. The README explains how to reproduce the issue in a Docker container using a vulnerable Composer image, verify absence of the marker file in /tmp, run 'composer install --prefer-dist', and then confirm successful execution by observing the created file. The exploit is operational but simple: it uses hardcoded shell commands as payloads rather than a customizable framework. There is no detection-only logic; the repository is intended to trigger exploitation directly.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A command injection vulnerability in PHP Composer's Perforce VCS driver affecting the syncCodeBase() method, enabling arbitrary command execution through unescaped source references in compromised repositories.
A critical command injection vulnerability in PHP Composer involving improper escaping of a source reference parameter appended to a shell command, allowing arbitrary command execution from malicious package metadata.
A command injection vulnerability in PHP Composer's Perforce VCS driver caused by insufficient escaping in syncCodeBase(), allowing arbitrary command execution through crafted source references from malicious or compromised repositories.
A high-severity command injection vulnerability in Composer's Perforce VCS driver caused by inadequate escaping and improper input validation, allowing arbitrary command execution through a crafted source reference.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.