[HIGH] Composer arbitrary command execution via a malicious package's Perforce source URL

PKSA-ym19-cy3j-z6df CVE-2026-84361 GHSA-rvx4-ffvw-m9q3

Affected package: composer/composer

Affected version: >=1.0,<2.2.30|>=2.3.0,<2.10.3

Reported by:
GitHub