Skip to content
OpenAdvisories
High ALAS2023-2026-1625 2 CVEs

Important: composer security update (Amazon Linux 2023)

Published Apr 27, 2026 · Updated Apr 30, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40261: Command injection via malicious Perforce source reference/url CVE-2026-40176: Command injection via malicious Perforce repository definition

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 composer 0:2.9.7-1.amzn2023.0.1

Vulnerabilities 2

  • High 8.8
    CVE-2026-40261 Public exploit

    Composer has Command Injection via Malicious Perforce Reference

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escapi…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist
  • High 7.8
    CVE-2026-40176 Public exploit

    Composer is vulnerable to Command Injection via Malicious Perforce Repository

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connecti…

    composer composer composer/composer composer Debian Ubuntu Alpine Wolfi Packagist

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-40176.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-40261.html