{"action":"Upgrade composer/composer to 2.2.30 or later.","affected":[{"fixed":"2.10.3","introduced":"2.3.0"},{"fixed":"2.2.30","introduced":"1.0"}],"component":"composer/composer","cve_ids":["CVE-2026-84361"],"ecosystem":"Packagist","epss":0.00502,"exploited":false,"fixed_versions":["2.10.3","2.2.30"],"ghsa_id":"GHSA-rvx4-ffvw-m9q3","id":"tcs_01M5KF8KEGA8KZERJ1CTEXC5AE","modified_at":"2026-09-08T21:30:05.586199402Z","published_at":"2026-09-08T21:25:41Z","references":["https://osv.dev/vulnerability/GHSA-rvx4-ffvw-m9q3","https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3","https://nvd.nist.gov/vuln/detail/CVE-2026-84361","https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220","https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af","https://github.com/composer/composer","https://github.com/composer/composer/releases/tag/2.10.3","https://github.com/composer/composer/releases/tag/2.2.30"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-rvx4-ffvw-m9q3","url":"https://osv.dev/vulnerability/GHSA-rvx4-ffvw-m9q3"}],"summary":"Composer arbitrary command execution via a malicious package's Perforce source URL"}