Detections
Analytics

SCA: security update for composer/composer (GHSA-wg36-wvj6-r67p)

high Tenable Cloud Security Plugin ID 440406

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a
 command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell
 commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper
 escaping. An attacker can inject arbitrary commands through these values in a malicious composer.json
 declaring a Perforce VCS repository, leading to command execution in the context of the user running
 Composer, even if Perforce is not installed. VCS repositories are only loaded from the root composer.json
 or the composer config directory, so this cannot be exploited through composer.json files of packages
 installed as dependencies. Users are at risk if they run Composer commands on untrusted projects with
 attacker-supplied composer.json files. This issue has been fixed in Composer 2.2.27 (2.2 LTS) and 2.9.6
 (mainline). (CVE-2026-40176)

Solution

Update the composer/composer library and its related packages to version 2.2.27 or later.

See Also

https://github.com/advisories/GHSA-wg36-wvj6-r67p

Plugin Details

Severity: High

ID: 440406

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 4/15/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.46

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-40176

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/14/2026

Vulnerability Publication Date: 4/14/2026

Reference Information

CVE: CVE-2026-40176