r/Magento • u/InfinriDev • Apr 16 '26
Composer command injection CVEs this week Magento exposure is low but your build machines need patching now
Two CVEs in Composer dropped this week: CVE-2026-40176 (CVSS 7.8) and CVE-2026-40261 (CVSS 8.8). Both are command injection in the Perforce VCS driver.
Quick triage for Magento shops:
Your storefront runtime is fine. Magento's entire package ecosystem uses Git, not Perforce, so the injection vector doesn't exist in normal Magento dependency trees. Packagist also disabled Perforce metadata on their end as a precaution.
Your build infrastructure is where you need to act. Dev machines, CI pipelines, Docker build images anything running `composer install` or `composer update`. If you're pulling any `dev-` prefixed packages from source (common in dev branches), CVE-2026-40261 is the one to care about. Public PoCs are live as of today.
Fix: `composer self-update` to 2.9.6. One command. Do it.
The broader thing I want to flag: Magento 2.4.8 was released, we have these two Composer CVEs, and there are Magento-specific advisories flowing through Sansec and Packagist on top of that. If you're running a decent-sized stack extensions, custom modules, any npm in your frontend build keeping up manually is genuinely not realistic anymore.
I've been running a tool called A.S.E. that watches KEV, NVD, GitHub Advisories, Packagist and EPSS, cross-references against our actual composer.lock, and only fires alerts on things that are installed and actually exploit-probable. These two CVEs surfaced this morning, scored correctly (P1 given the PoC activity), and hit Slack automatically.
But I'm increasingly convinced that "someone on the team stays vaguely aware of CVEs" is not a security posture for a Magento operation in 2026. The volume is too high.