CLSA-2026-1787064466
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787064466.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787064466
- Upstream
CVE (2)
- Published
- 2026-08-18T14:47:57Z
- Modified
- 2026-10-26T09:31:52Z
- Summary
- Fix CVE(s): CVE-2026-40176, CVE-2026-40261
- Details
-
- Non-maintainer upload by the TuxCare ELS team.
- CVE-2026-40261: Prevent a command injection vulnerability in
Perforce::syncCodeBase(), which appended the source reference to the
'p4 sync -f' command without escaping. Package metadata served by a
malicious or compromised Composer repository could inject shell
metacharacters, leading to command execution even when Perforce is not
installed.
- debian/patches/0018-CVE-2026-40261.patch
- CVE-2026-40176: Prevent a command injection vulnerability in
Perforce::generateP4Command(), which interpolated the Perforce
connection parameters (user, client, port) into the 'p4' command line
without escaping. A malicious composer.json declaring a Perforce VCS
repository could inject shell metacharacters, leading to command
execution even when Perforce is not installed. Also backport the
prerequisite upstream fix for Perforce::connectClient(), which passed
the client spec path through the shell redirection of the same command
line with only spaces escaped.
- debian/patches/0019-CVE-2026-40176.patch
- References