A critical command injection vulnerability in Composer allows unauthenticated attackers to execute arbitrary code on systems where untrusted project files are processed.

The vulnerability exists in the Perforce::generateP4Command() method, where user-supplied connection parameters are improperly sanitized before being used in shell command construction. This allows an attacker to achieve OS command injection by providing a crafted composer.json file containing a malicious Perforce VCS repository configuration.

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the user running the Composer process. This can lead to full system compromise, data exfiltration, or lateral movement within the development environment. With a CVSS score of 7.8, this vulnerability poses a significant risk to the integrity and confidentiality of software supply chains and development infrastructure.

Immediate Action: Upgrade Composer to version 2.9.6 for the mainline branch or 2.2.27 for the 2.2 LTS branch immediately.

Proactive Monitoring: Monitor build environments and developer workstations for unexpected shell processes spawned by the Composer executable.

Compensating Controls: Restrict the execution of Composer to isolated, non-privileged containers or virtualized build environments to minimize the impact of a potential compromise.

Public Exploit Available: Unknown

Given the severity of potential command execution, organizations must prioritize updating their Composer installations across all development and CI/CD pipelines. Ensure that all automated build systems are patched to the specified versions to prevent the processing of malicious repository configurations from compromising the development environment.