What versions of Composer are affected by CVE-2026-40176 and CVE-2026-40261?

Affected: >=2.3 =2.0 <2.2.27. Update to 2.9.6 or 2.2.27+.

Are there known exploits for Composer Perforce vulnerabilities?

No evidence on Packagist.org, but high CVSS scores mean craft one if motivated.

How do I secure Composer installs right now?

Patch immediately, vet composer.json for Perforce, use trusted sources, skip --prefer-dist.

🕳️ Vulnerabilities & CVEs

[CVE-2026-40176] Composer Flaws Enable Command Execution

Q: What versions of Composer are affected by CVE-2026-40176 and CVE-2026-40261?

Affected: >=2.3 =2.0 <2.2.27. Update to 2.9.6 or 2.2.27+.

Q: Are there known exploits for Composer Perforce vulnerabilities?

No evidence on Packagist.org, but high CVSS scores mean craft one if motivated.

Q: How do I secure Composer installs right now?

Patch immediately, vet composer.json for Perforce, use trusted sources, skip --prefer-dist.

PHP developers breathed easy with Composer's dominance in package management. Now, two command injection bugs shatter that trust, letting attackers run wild on unpatched systems—even without Perforce installed.

CVE Watch Apr 15, 2026 4 min read

⚡ Key Takeaways

Two command injection flaws (CVSS 7.8 & 8.8) in Composer enable arbitrary execution via malicious Perforce configs—even without Perforce installed. 𝕏
Patches released: Update to 2.9.6 or 2.2.27. Packagist disabled Perforce metadata as precaution. 𝕏
No known exploits, but supply-chain risks demand immediate audits of composer.json files. 𝕏