{"id":"CLSA-2026-1787064466","summary":"Fix CVE(s): CVE-2026-40176, CVE-2026-40261","details":"   * Non-maintainer upload by the TuxCare ELS team.\n   * CVE-2026-40261: Prevent a command injection vulnerability in\n     Perforce::syncCodeBase(), which appended the source reference to the\n     'p4 sync -f' command without escaping. Package metadata served by a\n     malicious or compromised Composer repository could inject shell\n     metacharacters, leading to command execution even when Perforce is not\n     installed.\n     - debian/patches/0018-CVE-2026-40261.patch\n   * CVE-2026-40176: Prevent a command injection vulnerability in\n     Perforce::generateP4Command(), which interpolated the Perforce\n     connection parameters (user, client, port) into the 'p4' command line\n     without escaping. A malicious composer.json declaring a Perforce VCS\n     repository could inject shell metacharacters, leading to command\n     execution even when Perforce is not installed. Also backport the\n     prerequisite upstream fix for Perforce::connectClient(), which passed\n     the client spec path through the shell redirection of the same command\n     line with only spaces escaped.\n     - debian/patches/0019-CVE-2026-40176.patch","modified":"2026-10-26T09:31:52.613459333Z","published":"2026-08-18T14:47:57Z","upstream":["CVE-2026-40176","CVE-2026-40261"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1787064466.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40176"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40261"}],"affected":[{"package":{"name":"composer","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/composer?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-1+deb10u4+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787064466.json"}}],"schema_version":"1.9.0"}