The vulnerability originates in the Composer dependency manager’s Perforce::generateP4Command() routine, which concatenates user‐controlled connection parameters—port, user, and client—directly into a shell command without quoting or escaping. This allows an attacker to place arbitrary shell code in these fields of a malicious composer.json file that declares a Perforce VCS repository. When Composer is run in the context of the attacker’s set of repository parameters, the injected code is executed by the user running Composer, providing full command execution on that system. The flaw is a classic command injection, classified as CWE‑20 and CWE‑78.

Affected releases of Composer span version ranges 1.0 through 2.2.26 and 2.3 through 2.9.5. The issue is fixed from Composer 2.2.27 onward and from 2.9.6 in the mainline. Only the root composer.json or the Composer configuration directory are considered during VCS loading, meaning that dependency package composer.json files cannot trigger the flaw. Users are at risk only when they run Composer commands against untrusted projects that contain an attacker‑supplied composer.json with a Perforce VCS repository.

The CVSS score of 7.8 indicates a high‑severity vulnerability. The EPSS score is not provided, suggesting no measurement of exploitation probability is available at this time. The flaw is not listed in CISA’s KEV catalog, so no confirmed active exploits are documented. Exploitation requires the attacker to supply a crafted composer.json file, so it is contingent on the user executing Composer on untrusted input. In practice, the most likely vector is a developer pulling a project from a source that an attacker controls, leading to execution in the developer’s user context.