Composer, the PHP dependency manager, has a flaw in versions 1.0 through 2.2.29 and 2.10.2 where an attacker who can supply a malicious package or modify composer.lock may set a Perforce source with an rsh: or jsh: P4PORT value. When the Perforce client is installed and Composer processes the source during install or update, the address is passed straight to the p4 command line without validation, causing p4 to execute a local command with the privileges of the user or continuous‑integration account. This results in arbitrary command execution, compromising confidentiality, integrity, and availability of the affected system. The issue is fixed in Composer versions 2.2.30 and 2.10.3.

The vulnerability affects any installation of Composer 1.0 up to 2.2.29 and 2.10.2 that uses the Perforce source type. Systems running those Composer versions with a Perforce client installed and processing untrusted composer.json or composer.lock files are at risk. Packagist.org does not allow Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

The CVSS score is 7.7, indicating a moderate‑to‑high severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation has been observed yet. Attackers must supply a malicious package or tamper with the lockfile and rely on the target system having a Perforce client. After the attacker completes the install or update, p4 runs a locally supplied command with the effective user’s rights. This is an inferred local‑command‑execution vector that would require remote code manipulation of package metadata.