Threats affecting pkg:composer/composer/composer

Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method. This flaw allows an attacker to inject arbitrary shell commands via specially crafted Perforce connection parameters in a malicious composer.json file. Exploitation requires running Composer commands on untrusted projects with attacker-supplied composer.json files. The vulnerability has been fixed in Composer versions 2.2.27 and 2.9.6.