Composer versions >=1.0.0 <2.2.27 and >=2.3.0 <2.9.6 have a command injection vulnerability in the Perforce integration methods. The Perforce::syncCodeBase() method appends the $sourceReference parameter directly to shell commands without proper escaping, and Perforce::generateP4Command() interpolates user-supplied Perforce connection parameters from the source URL without escaping. This allows an attacker to inject arbitrary shell commands via crafted source reference or URL values in package metadata. Because package metadata can come from any Composer repository, a compromised or malicious repository can serve malicious metadata to trigger this vulnerability during dependency installation or updates from source, including default behavior for dev-prefixed versions. The vulnerability is fixed in Composer 2.2.27 (LTS) and 2.9.6 (mainline).

An attacker controlling or compromising a Composer repository can execute arbitrary shell commands on a developer's system during dependency installation or update processes that involve source installs. This can lead to remote code execution on the developer's machine. The vulnerability affects all users installing or updating dependencies from source with affected Composer versions. It does not require Perforce to be installed on the target system. There are no known exploits in the wild at this time.

A fix is available in Composer versions 2.2.27 and 2.9.6. Users should upgrade to these versions or later. If immediate upgrade is not possible, users can mitigate risk by avoiding installing dependencies from source using the --prefer-dist option or setting preferred-install to dist in Composer configuration. Additionally, only trusted Composer repositories should be used to prevent malicious package metadata injection.