Threats tagged 'ghsa-wg36-wvj6-r67p'

Composer versions prior to 2.2.27 and 2.9.6 contain a command injection vulnerability in the Perforce::generateP4Command() method. This flaw allows an attacker to inject arbitrary shell commands via malicious Perforce repository configuration parameters in a composer.json file. Exploitation requires running Composer commands on untrusted projects with attacker-supplied composer.json files. The vulnerability is limited to the user context running Composer and does not affect dependencies' composer.json files. Fixed in Composer 2.2.27 and 2.9.6.