{"action":"Upgrade composer/composer to 2.2.27 or later.","affected":[{"fixed":"2.9.6","introduced":"2.3.0"},{"fixed":"2.2.27","introduced":"1.0.0"}],"component":"composer/composer","cve_ids":["CVE-2026-40261"],"ecosystem":"Packagist","epss":0.01688,"exploited":false,"fixed_versions":["2.9.6","2.2.27"],"ghsa_id":"GHSA-gqw4-4w2p-838q","id":"tcs_01M5KF31WM87Q80QH4C30RYT39","modified_at":"2026-09-10T03:51:01.816745047Z","published_at":"2026-04-14T20:01:42Z","references":["https://osv.dev/vulnerability/GHSA-gqw4-4w2p-838q","https://github.com/composer/composer/security/advisories/GHSA-gqw4-4w2p-838q","https://nvd.nist.gov/vuln/detail/CVE-2026-40261","https://access.redhat.com/errata/RHSA-2026:8165","https://access.redhat.com/security/cve/CVE-2026-40261","https://bugzilla.redhat.com/show_bug.cgi?id=2458841","https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-40261.yaml","https://github.com/composer/composer","https://github.com/composer/composer/releases/tag/2.9.6","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40261.json"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-gqw4-4w2p-838q","url":"https://osv.dev/vulnerability/GHSA-gqw4-4w2p-838q"}],"summary":"Composer has a command injection via malicious perforce reference"}