Detections
Analytics

Alpine: multiple composer packages: security update to 2.10.3-r0

high Tenable Self-Hosted Container Security Plugin ID 476571

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3,
 a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because
 Composer validates literal parent-directory segments only during dependency resolution, while the symlink
 and installed-metadata paths described by the advisory skip that validation. A package can ship an in-
 package binary symlink that resolves outside its installation directory, or attacker-influenced
 vendor/composer/installed.json metadata can provide an escaping binary path during a reinstall or
 regeneration of missing vendor/bin entries. The installed-metadata path is reachable only when the vendor
 directory was not populated by the same validated install run, such as when it is restored from an
 untrusted cache, copied from an earlier build stage, carried over from an older Composer run, or writable
 by a lower-trust build step. Composer can follow the path, change the external target's permissions to
 make it world-readable and executable, and create a runnable vendor/bin proxy to that external file. The
 issue does not directly read or transmit data and does not by itself provide remote code execution. This
 issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-59944)

 - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious
 dependency package from a custom Composer repository or an untrusted composer.lock file could set
 source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was
 installed and Composer installed the package from source through composer install or composer update,
 including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4
 to run a local command with the privileges of the user or CI account. Packagist.org does not permit
 Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3. (CVE-2026-84361)

Solution

Update the composer library and its related packages to version 2.10.3-r0 or later.

See Also

https://security.alpinelinux.org/vuln/CVE-2026-59944

https://security.alpinelinux.org/vuln/CVE-2026-84361

Plugin Details

Severity: High

ID: 476571

Version: Revision 1.1

Type: Local

Published: 10/22/2026

Updated: 10/22/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.53

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-84361

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2026-59944

CVSS v4

Risk Factor: High

Base Score: 7.7

Threat Score: 6.8

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 8/27/2026

Reference Information

CVE: CVE-2026-59944, CVE-2026-84361