A critical OS command injection vulnerability in Composer allows unauthenticated attackers to execute arbitrary code by supplying malicious package metadata.

This vulnerability resides in the Perforce::syncCodeBase and Perforce::generateP4Command methods, where user-supplied parameters are interpolated into shell commands without proper escaping. An unauthenticated attacker can trigger this flaw by providing crafted source reference or source URL values within package metadata.

Successful exploitation allows an attacker to achieve remote code execution on the machine running Composer, which typically includes developer workstations or CI/CD build servers. Given the CVSS score of 8.8, this poses a high risk to the integrity and confidentiality of the development pipeline, potentially leading to supply chain compromise, credential theft, or unauthorized access to internal infrastructure.

Immediate Action: Update Composer to version 2.2.27 (for the 2.2 LTS branch) or 2.9.6 (for the mainline branch) immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Monitor build logs and developer environment activity for suspicious shell commands or unexpected outgoing connections originating from the Composer process.

Compensating Controls: If immediate updates are not possible, restrict the use of untrusted or third-party repositories and verify the integrity of package metadata before installation.

Public Exploit Available: Unknown

The severity of this command injection vulnerability necessitates an immediate organization-wide update of all Composer installations. Security teams must prioritize patching CI/CD environments and developer workstations to prevent potential supply chain attacks. Failure to remediate this issue exposes development infrastructure to full system compromise.