Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the Perforce::generateP4Command() method as in GHSA-wg36-wvj6-r67p / CVE-2026-40176, which interpolates user-supplied Perforce connection parameters (port, user, client) from the source url field without proper escaping. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed. Unlike CVE-2026-40176, the source reference and url are provided as part of package metadata, meaning any compromised or malicious Composer repository can serve package metadata declaring perforce as a source type with malicious values. This vulnerability is exploitable when installing or updating dependencies from source, including the default behavior when installing dev-prefixed versions. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6 (mainline). If developers are unable to immediately update, they can avoid installing dependencies from source by using --prefer-dist or the preferred-install: dist config setting, and only use trusted Composer repositories as a workaround.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1625 advisory.

    Command injection via malicious Perforce repository definition (CVE-2026-40176)

    Command injection via malicious Perforce source reference/url (CVE-2026-40261)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1140c02041 advisory.

    ### Version 2.9.7 - 2026-04-14

    * Fixes regression calling custom script command aliases that are called a substring of a composer command     (#12802)

    ----

    ### Version 2.9.6 -  2026-04-14

      * Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q /
    **CVE-2026-40261**)
      * Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p /
    **CVE-2026-40176**)
      * Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed     (2bcbfc3d)
      * Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
      * Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
      * Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with     `-` do not cause issues (6621d45, d836b90, 5e08c764)
      * Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
      * Fixed GitHub API authentication errors not being visible to the user (#12737)
      * Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
      * Fixed error reporting for clarity when a constraint cannot be parsed (#12743)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d91f313a63 advisory.

    ### Version 2.9.7 - 2026-04-14

    * Fixes regression calling custom script command aliases that are called a substring of a composer command     (#12802)

    ----

    ### Version 2.9.6 -  2026-04-14

      * Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q /
    **CVE-2026-40261**)
      * Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p /
    **CVE-2026-40176**)
      * Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed     (2bcbfc3d)
      * Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
      * Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
      * Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with     `-` do not cause issues (6621d45, d836b90, 5e08c764)
      * Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
      * Fixed GitHub API authentication errors not being visible to the user (#12737)
      * Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
      * Fixed error reporting for clarity when a constraint cannot be parsed (#12743)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7a7a17b2-381c-11f1-a663-10ffe07f9334 advisory.

    Composer project reports:
    Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)     Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p /     CVE-2026-40176)

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-02c1f66b6a advisory.

    ### Version 2.9.7 - 2026-04-14

    * Fixes regression calling custom script command aliases that are called a substring of a composer command     (#12802)

    ----

    ### Version 2.9.6 -  2026-04-14

      * Security: Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q /
    **CVE-2026-40261**)
      * Security: Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p /
    **CVE-2026-40176**)
      * Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed     (2bcbfc3d)
      * Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
      * Security: Fixed Perforce unescaped user input in queryP4User shell command (ef3fc088)
      * Security: Hardened git/hg/perforce/fossil identifier validation to ensure branch names starting with     `-` do not cause issues (6621d45, d836b90, 5e08c764)
      * Fixed inconsistent treatment of SingleCommandApplication script commands wrt autoloading (#12758)
      * Fixed GitHub API authentication errors not being visible to the user (#12737)
      * Fixed some platform package parsing failing when Composer runs in web SAPIs (#12735)
      * Fixed error reporting for clarity when a constraint cannot be parsed (#12743)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a     command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference     parameter to a shell command without proper escaping, and additionally in the     Perforce::generateP4Command() method as in GHSA-wg36-wvj6-r67p / CVE-2026-40176, which interpolates user-     supplied Perforce connection parameters (port, user, client) from the source url field without proper     escaping. An attacker can inject arbitrary commands through crafted source reference or source url values     containing shell metacharacters, even if Perforce is not installed. Unlike CVE-2026-40176, the source     reference and url are provided as part of package metadata, meaning any compromised or malicious Composer     repository can serve package metadata declaring perforce as a source type with malicious values. This     vulnerability is exploitable when installing or updating dependencies from source, including the default     behavior when installing dev-prefixed versions. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and     2.9.6 (mainline). If developers are unable to immediately update, they can avoid installing dependencies     from source by using --prefer-dist or the preferred-install: dist config setting, and only use trusted     Composer repositories as a workaround. (CVE-2026-40261)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
311337	Amazon Linux 2023 : composer (ALAS2023-2026-1625)	Nessus	Amazon Linux Local Security Checks	high
310220	Fedora 44 : composer (2026-1140c02041)	Nessus	Fedora Local Security Checks	high
309858	Fedora 42 : composer (2026-d91f313a63)	Nessus	Fedora Local Security Checks	high
306638	FreeBSD : PHP Composer -- Multiple vulnerabilities (7a7a17b2-381c-11f1-a663-10ffe07f9334)	Nessus	FreeBSD Local Security Checks	high
306621	Fedora 43 : composer (2026-02c1f66b6a)	Nessus	Fedora Local Security Checks	high
306564	Linux Distros Unpatched Vulnerability : CVE-2026-40261	Nessus	Misc.	high

Detections

Analytics

CVE-2026-40261

high

Tenable Plugins

high

high

high

high

high

high