{"vulnerability": "CVE-2026-84361", "sightings": [{"uuid": "9b2c13f3-9ac9-4af4-a204-d07bd82fa544", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84361", "type": "published-proof-of-concept", "source": "Telegram/Zg7xNPwQElgOazaR_8r2v4bs6d55u6MTShsUIaSZkGoRM78", "content": "", "creation_timestamp": "2026-09-02T10:00:05.757956Z"}, {"uuid": "6f18b6c6-1e97-4b95-84d8-fd4ce5ee7b91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84361", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100749", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-84361-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-02 05:26:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-02T09:00:06.420622Z"}, {"uuid": "1a30970e-8649-4422-b095-8b4118b8f8b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84361", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muk26aw6u72y", "content": "CVE-2026-84361 - composer\nIf you use Composer versions earlier than 2.2.30 or 2.10.3, a malicious package can trick Composer into executing a command on your server through a specially crafted Perforce address. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#composer #CVE #infosec", "creation_timestamp": "2026-09-02T13:30:04.720942Z"}, {"uuid": "60dd65ef-8d1d-4b0e-8d9c-139ac15d36d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84361", "type": "published-proof-of-concept", "source": "Telegram/Zg7xNPwQElgOazaR_8r2v4bs6d55u6MTShsUIaSZkGoRM78", "content": "", "creation_timestamp": "2026-09-03T00:00:50.465070Z"}, {"uuid": "beedac6b-e391-4bcd-a6f0-370d2779c574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84361", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100749", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-84361-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-02 05:26:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-03T00:00:51.481036Z"}, {"uuid": "25ebcebe-b271-429b-882a-b014d094a2cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84361", "type": "seen", "source": "https://gist.github.com/alon710/a3c9901fd3145b4f83e29fe00422ecb3", "content": "# CVE-2026-84361: CVE-2026-84361: Remote Code Execution in Composer Perforce VCS Driver\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84361\n\n## Summary\nA critical remote code execution vulnerability exists in the Composer PHP dependency manager due to improper neutralization of command parameters passed to the Perforce CLI client. Unauthenticated attackers can exploit this flaw via crafted package metadata in custom repositories or lock files, triggering arbitrary OS command execution when a user or automated CI/CD pipeline runs Composer commands.\n\n## TL;DR\nUnauthenticated remote command execution in Composer's Perforce VCS driver via malicious repository configurations or lock files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Network\n- **CVSS Score**: 7.7\n- **EPSS Score**: 0.00409\n- **Impact**: Remote Code Execution (RCE)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Composer < 2.2.30\n- Composer 2.3.x to < 2.10.3\n- **Composer**: >= 1.0, < 2.2.30 (Fixed in: `2.2.30`)\n- **Composer**: >= 2.3.0, < 2.10.3 (Fixed in: `2.10.3`)\n\n## Mitigation\n\n- Upgrade Composer to version 2.2.30 (LTS) or 2.10.3 (Stable) or higher.\n- Remove the p4 Perforce command-line utility from systems where Perforce is not required.\n- Enforce schema validation on private or custom package registries to block package definitions using the perforce source type with untrusted URL structures.\n\n**Remediation Steps:**\n1. Identify systems running vulnerable Composer versions (less than 2.2.30, or between 2.3.0 and 2.10.2).\n2. Run 'composer self-update' or update via system package manager to acquire version 2.2.30 or 2.10.3+.\n3. Inspect dependency resolution environments (CI/CD build servers, local workstations) and remove the 'p4' binary if it is not explicitly required.\n4. Scan local configurations using automated scripts or rules (e.g., YARA or grep) to detect malicious rsh: or jsh: commands in composer.json or composer.lock files.\n\n## References\n\n- [GitHub Security Advisory GHSA-rvx4-ffvw-m9q3](https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3)\n- [Composer Fix Commit (0aac505)](https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220)\n- [Composer Fix Commit (199ad81)](https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af)\n- [Composer Release 2.10.3](https://github.com/composer/composer/releases/tag/2.10.3)\n- [Composer Release 2.2.30](https://github.com/composer/composer/releases/tag/2.2.30)\n- [Saku0512 Proof of Concept Repository](https://github.com/Saku0512/CVE-2026-84361-poc)\n- [PoC README](https://raw.githubusercontent.com/Saku0512/CVE-2026-84361-poc/main/README.md)\n- [PoC composer.json](https://raw.githubusercontent.com/Saku0512/CVE-2026-84361-poc/main/composer.json)\n- [PoC php simulation script](https://raw.githubusercontent.com/Saku0512/CVE-2026-84361-poc/main/poc.php)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84361) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T14:32:49.605452Z"}, {"uuid": "732a875a-306e-42b1-a051-e124c5ce1876", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84361", "type": "seen", "source": "https://t.me/bdufstecru/3440", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f PHP Composer \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b\n\nBDU:2026-14209\nCVE-2026-84361\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3\nhttps://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220\nhttps://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af", "creation_timestamp": "2026-09-15T15:00:05.857187Z"}, {"uuid": "29e36347-848c-4fc1-ab1e-c9db106ae54e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84361", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3440", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f PHP Composer \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435\u043c \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b\n\nBDU:2026-14209\nCVE-2026-84361\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-m9q3\nhttps://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220\nhttps://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af", "creation_timestamp": "2026-09-16T00:00:29.687615Z"}]}