--- title: "Composer 2.9.6 Fixes Two Perforce Command Injection Vulnerabilities" url: https://daily.dev/posts/composer-2-9-6-fixes-two-perforce-command-injection-vulnerabilities-1cyx9zwzx source_url: https://laravel-news.com/composer-296-fixes-two-perforce-command-injection-vulnerabilities type: article source: "Laravel News" author: "Eric L. Barnes" published: 2026-04-15T17:51:50.070Z updated: 2026-04-16T14:00:28.811Z tags: ["php"] reading_time: 2 upvotes: 25 comments: 3 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Composer 2.9.6 Fixes Two Perforce Command Injection Vulnerabilities **[Laravel News](https://daily.dev/sources/ln)** · [@ericlbarnes](https://daily.dev/ericlbarnes) · 2 min read · 25 upvotes · 3 comments ## Summary Composer 2.9.6 and 2.2.27 LTS have been released to patch two command injection vulnerabilities (CVE-2026-40261 and CVE-2026-40176) in the Perforce VCS driver. The first flaw affects the generateP4Command() method and can be triggered via malicious Perforce connection parameters in a root composer.json. The second affects syncCodeBase() and allows injection via a crafted source reference when installing dependencies from a compromised repository, even without Perforce installed. No exploitation in the wild has been detected. Users should run `composer self-update` immediately and prefer --prefer-dist installs to reduce exposure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@sam7work** · 1 upvotes > ok, yeah do update your composer , seriously **@muken** · 0 upvotes > Thank you for this information! It is very important to update your composer. --- Tags: [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/composer-2-9-6-fixes-two-perforce-command-injection-vulnerabilities-1cyx9zwzx)