[{"uuid":"GSA_kwCzR0hTQS1taDZ3LXZ4ZmYtOXdxcM4ABVl_","url":"https://github.com/advisories/GHSA-mh6w-vxff-9wqp","title":"PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes","description":"# Impact\n\nPHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as `-d name=value` command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets `\"` as a string delimiter, `;` as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as **multiple INI directives**.\n\nAn attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including `auto_prepend_file`, `extension`, `disable_functions`, `open_basedir`, and others. Setting `auto_prepend_file` to an attacker-controlled path yields **remote code execution** in the child process.\n\n**Sources of INI values that participate in the attack:**\n\n- `\u003cini name=\"…\" value=\"…\"/\u003e` entries in `phpunit.xml` / `phpunit.xml.dist`\n- INI settings inherited from the host PHP runtime via `ini_get_all()`\n\n## Threat Model\n\nExploitation requires the attacker to control the content of an INI value read by PHPUnit. In practice this means write access to the project's `phpunit.xml`, the host `php.ini`, or the PHP binary's environment. The most realistic exposure is **Poisoned Pipeline Execution (PPE)**: a pull request from an untrusted contributor that modifies `phpunit.xml` to include a newline-containing INI value, executed by a CI system that runs PHPUnit against the PR without isolation. A malicious newline is not visibly distinguishable from a legitimate value in a typical diff review.\n\n## Affected Component\n\n`PHPUnit\\Util\\PHP\\JobRunner::settingsToParameters()`\n\n## Patches\n\nThe fix has two parts:\n\n### 1. Reject line-break characters\n\nBecause a newline or carriage return in an INI value has no legitimate use and is the primitive that enables directive injection, any PHP setting value containing `\\n` or `\\r` is now rejected with an explicit `PhpProcessException`. This follows the same \"visibility over silence\" principle applied in **CVE-2026-24765**: the anomalous state fails loudly in CI output rather than being silently sanitized, giving operators an opportunity to investigate whether it reflects tampering, environment contamination, or an unexpected upstream change.\n\n### 2. Quote remaining metacharacters\n\nValues containing `\"` or `;`, both of which have legitimate uses (e.g., regex-valued INI settings such as ddtrace's `datadog.appsec.obfuscation_parameter_value_regexp`), are wrapped in double quotes with inner `\"` escaped as `\\\"`, so PHP's INI parser reads them as literal string contents rather than comment/delimiter tokens. Plain values are forwarded unchanged so that boolean keywords (`On`/`Off`) and bitwise expressions (`E_ALL \u0026 ~E_NOTICE`) retain their INI semantics.\n\n## Workarounds\n\nIf upgrading is not immediately possible:\n\n1. **Audit INI values:** Ensure no `\u003cini value=\"…\"\u003e` entry in `phpunit.xml` / `phpunit.xml.dist` contains newline, `\"`, or `;` characters, and that nothing writes such values into configuration at build time.\n2. **Isolate CI execution of untrusted code:** Run PHPUnit against pull requests only in ephemeral, containerized runners that discard filesystem state between jobs; require human review before executing PRs from forks; enforce branch protection on workflows that handle secrets (`pull_request_target` and similar). These mitigations apply to the broader PPE risk class and are effective against this vulnerability as well.\n3. **Restrict who can modify `phpunit.xml`:** Treat `phpunit.xml` as security-sensitive in code review, particularly `\u003cini\u003e` entries.\n4. **Sanitize host INI:** Ensure the host PHP's `php.ini` does not contain values with embedded newlines or unescaped metacharacters.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-22T14:56:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.8,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243","https://github.com/sebastianbergmann/phpunit/pull/6592","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/GHSA-qrr6-mg7r-m243.yaml","https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution","https://github.com/advisories/GHSA-mh6w-vxff-9wqp"],"source_kind":"github","identifiers":["GHSA-mh6w-vxff-9wqp"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-22T15:00:09.103Z","updated_at":"2026-09-28T20:03:54.698Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1taDZ3LXZ4ZmYtOXdxcM4ABVl_","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1taDZ3LXZ4ZmYtOXdxcM4ABVl_","packages":[{"ecosystem":"packagist","package_name":"phpunit/phpunit","versions":[{"first_patched_version":"13.1.6","vulnerable_version_range":"\u003e= 13.1.5, \u003c 13.1.6"},{"first_patched_version":"12.5.22","vulnerable_version_range":"\u003e= 12.5.21, \u003c 12.5.22"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1taDZ3LXZ4ZmYtOXdxcM4ABVl_/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1xcnI2LW1nN3ItbTI0M84ABVcx","url":"https://github.com/advisories/GHSA-qrr6-mg7r-m243","title":"PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes","description":"## Impact\n\nPHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as `-d name=value` command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets `\"` as a string delimiter, `;` as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives.\n\nAn attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including `auto_prepend_file`, `extension`, `disable_functions`, `open_basedir`, and others. Setting `auto_prepend_file` to an attacker-controlled path yields remote code execution in the child process.\n\nSources of INI values that participate in the attack:\n\n- `\u003cini name=\"…\" value=\"…\"/\u003e` entries in `phpunit.xml` / `phpunit.xml.dist`\n- INI settings inherited from the host PHP runtime via `ini_get_all()`\n\n### Threat Model\n\nExploitation requires the attacker to control the content of an INI value read by PHPUnit. In practice this means write access to the project's `phpunit.xml`, the host `php.ini`, or the PHP binary's environment. The most realistic exposure is [Poisoned Pipeline Execution](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution) (PPE): a pull request from an untrusted contributor that modifies `phpunit.xml` to include a newline-containing INI value, executed by a CI system that runs PHPUnit against the PR without isolation. A malicious newline is not visibly distinguishable from a legitimate value in a typical diff review.\n\n### Affected component\n\n`PHPUnit\\Util\\PHP\\JobRunner::settingsToParameters()`.\n\n## Patches\n\nThe fix has two parts:\n\n**1. Reject line-break characters**\n\nBecause a newline or carriage return in an INI value has no legitimate use and is the primitive that enables directive injection, any PHP setting value containing `\\n` or `\\r` is now rejected with an explicit `PhpProcessException`. This follows the same \"visibility over silence\" principle applied in [CVE-2026-24765](https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p): the anomalous state fails loudly in CI output rather than being silently sanitized, giving operators an opportunity to investigate whether it reflects tampering, environment contamination, or an unexpected upstream change.\n\n**2. Quote remaining metacharacters**\n\nValues containing `\"` or `;`, both of which have legitimate uses (e.g., regex-valued INI settings such as `ddtrace`'s `datadog.appsec.obfuscation_parameter_value_regexp`), are wrapped in double quotes with inner `\"` escaped as `\\\"`, so PHP's INI parser reads them as literal string contents rather than comment/delimiter tokens. Plain values are forwarded unchanged so that boolean keywords (`On`/`Off`) and bitwise expressions (`E_ALL \u0026 ~E_NOTICE`) retain their INI semantics.\n\n## Workarounds\n\nIf upgrading is not immediately possible:\n\n- Audit INI values: Ensure no `\u003cini value=\"…\"\u003e` entry in `phpunit.xml` / `phpunit.xml.dist` contains newline, `\"`, or `;` characters, and that nothing writes such values into configuration at build time.\n- Isolate CI execution of untrusted code: Run PHPUnit against pull requests only in ephemeral, containerized runners that discard filesystem state between jobs; require human review before executing PRs from forks; enforce branch protection on workflows that handle secrets (`pull_request_target` and similar). These mitigations apply to the broader PPE risk class and are effective against this vulnerability as well.\n- Restrict who can modify `phpunit.xml`: Treat `phpunit.xml` as security-sensitive in code review, particularly `\u003cini\u003e` entries.\n- Sanitize host INI: Ensure the host PHP's `php.ini` does not contain values with embedded newlines or unescaped metacharacters.\n\n## References\n\n- Fix: https://github.com/sebastianbergmann/phpunit/pull/6592\n- Related advisory (same threat class, Poisoned Pipeline Execution): [GHSA-vvj3-c3rp-c85p / CVE-2026-24765](https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p)\n- OWASP CI/CD Top 10: [CICD-SEC-04 Poisoned Pipeline Execution](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution)\n- CWE-88: https://cwe.mitre.org/data/definitions/88.html\n- CWE-93: https://cwe.mitre.org/data/definitions/93.html","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-18T00:59:28.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.8,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243","https://github.com/sebastianbergmann/phpunit/pull/6592","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2026-41570.yaml","https://nvd.nist.gov/vuln/detail/CVE-2026-41570","https://github.com/advisories/GHSA-qrr6-mg7r-m243"],"source_kind":"github","identifiers":["GHSA-qrr6-mg7r-m243","CVE-2026-41570"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-18T01:00:10.361Z","updated_at":"2026-09-28T20:03:56.687Z","epss_percentage":0.00284,"epss_percentile":0.18568,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xcnI2LW1nN3ItbTI0M84ABVcx","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xcnI2LW1nN3ItbTI0M84ABVcx","packages":[{"ecosystem":"packagist","package_name":"phpunit/phpunit","versions":[{"first_patched_version":"13.1.6","vulnerable_version_range":"= 13.1.5"},{"first_patched_version":"12.5.22","vulnerable_version_range":"= 12.5.21"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xcnI2LW1nN3ItbTI0M84ABVcx/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12dmozLWMzcnAtYzg1cM4ABRo_","url":"https://github.com/advisories/GHSA-vvj3-c3rp-c85p","title":"PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling","description":"### Overview\n\nA vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test.\n\n### Technical Details\n\n**Affected Component:** PHPT test runner, method `cleanupForCoverage()`\n**Affected Versions:** \u003c= 8.5.51, \u003c= 9.6.32, \u003c= 10.5.61, \u003c= 11.5.49, \u003c= 12.5.7\n\n### Vulnerable Code Pattern\n\n```php\nif ($buffer !== false) {\n    // Unsafe call without restrictions\n    $coverage = @unserialize($buffer);\n}\n```\n\nThe vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.\n\n### Attack Prerequisites and Constraints\n\nThis vulnerability requires **local file write access** to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:\n\n* **CI/CD Pipeline Attacks:** A malicious pull request that places a `.coverage` file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information\n* **Local Development Environment:** An attacker with shell access or ability to write files to the project directory\n* **Compromised Dependencies:** A supply chain attack inserting malicious files into a package or monorepo\n\n**Critical Context:** Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of [Poisoned Pipeline Execution (PPE) attacks](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution) affecting CI/CD systems.\n\n### Proposed Remediation Approach\n\nRather than just silently sanitizing the input via `['allowed_classes' =\u003e false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition.\n\n#### Rationale for Error-Based Approach:\n\n1. **Visibility Over Silence:** When an invariant is violated (a `.coverage` file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input\n2. **Operational Security:** A `.coverage` file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:\n    * A malicious actor placed it intentionally\n    * Build artifacts from a previous run contaminated the environment\n    * An unexpected filesystem state requiring investigation\n3. **Defense-in-Depth Principle:** Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:\n    * Isolate CI/CD runners (ephemeral, containerized environments)\n    * Restrict code execution on protected branches\n    * Scan pull requests and artifacts for tampering\n    * Use branch protection rules to prevent unreviewed code execution\n\n### Severity Classification\n\n* **Attack Vector (AV):** Local (L) — requires write access to the file system where tests execute\n* **Attack Complexity (AC):** Low (L) — exploitation is straightforward once the malicious file is placed\n* **Privileges Required (PR):** Low (L) — PR submitter status or contributor role provides sufficient access\n* **User Interaction (UI):** None (N) — automatic execution during standard test execution\n* **Scope (S):** Unchanged (U) — impact remains within the affected test execution context\n* **Confidentiality Impact (C):** High (H) — full remote code execution enables complete system compromise\n* **Integrity Impact (I):** High (H) — arbitrary code execution allows malicious modifications\n* **Availability Impact (A):** High (H) — full code execution permits denial-of-service actions\n\n### Mitigating Factors (Environmental Context)\n\nOrganizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:\n\n* **Ephemeral Runners:** Use containerized, single-use CI/CD runners that discard filesystem state between runs\n* **Code Review Enforcement:** Require human review and approval before executing code from pull requests\n* **Branch Protection:** Enforce branch protection rules that block unreviewed code execution\n* **Artifact Isolation:** Separate build artifacts from source; never reuse artifacts across independent builds\n* **Access Control:** Limit file write permissions in CI environments to authenticated, trusted actors\n\n### Fixed Behaviour\n\nWhen a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:\n\n* **Visibility:** The error appears prominently in CI/CD output and test logs\n* **Investigation:** Operations teams can investigate the root cause (potential tampering, environment contamination)\n* **Fail-Fast Semantics:** Test execution stops rather than proceeding with an unexpected state\n\n### Recommendation\n\n**Update to the patched version immediately** if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:\n\n* Pull requests from forks or untrusted sources execute in isolated environments\n* Branch protection rules require human review before code execution\n* CI/CD runners are ephemeral and discarded after each build\n* Build artifacts are not reused across independent runs without validation","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-01-27T22:26:22.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.8,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","https://github.com/sebastianbergmann/phpunit/commit/613d142f5a8471ca71623ce5ca2795f79248329e","https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution","https://nvd.nist.gov/vuln/detail/CVE-2026-24765","https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2026-24765.yaml","https://github.com/advisories/GHSA-vvj3-c3rp-c85p"],"source_kind":"github","identifiers":["GHSA-vvj3-c3rp-c85p","CVE-2026-24765"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-01-27T23:00:07.789Z","updated_at":"2026-09-30T09:05:51.419Z","epss_percentage":0.0039,"epss_percentile":0.30506,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12dmozLWMzcnAtYzg1cM4ABRo_","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12dmozLWMzcnAtYzg1cM4ABRo_","packages":[{"ecosystem":"packagist","package_name":"phpunit/phpunit","versions":[{"first_patched_version":"12.5.8","vulnerable_version_range":"\u003e= 12.0.0, \u003c 12.5.8"},{"first_patched_version":"11.5.50","vulnerable_version_range":"\u003e= 11.0.0, \u003c 11.5.50"},{"first_patched_version":"10.5.62","vulnerable_version_range":"\u003e= 10.0.0, \u003c 10.5.62"},{"first_patched_version":"9.6.33","vulnerable_version_range":"\u003e= 9.0.0, \u003c 9.6.33"},{"first_patched_version":"8.5.52","vulnerable_version_range":"\u003c 8.5.52"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12dmozLWMzcnAtYzg1cM4ABRo_/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yN2M5LWM2OW0tcnBoOM02Aw","url":"https://github.com/advisories/GHSA-r7c9-c69m-rph8","title":"Code Injection in PHPUnit","description":"Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `\u003c?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-03-26T00:19:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2017-9841","https://github.com/sebastianbergmann/phpunit/pull/1956","https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5","https://security.gentoo.org/glsa/201711-15","https://www.oracle.com/security-alerts/cpuoct2021.html","http://www.securityfocus.com/bid/101798","http://www.securitytracker.com/id/1039812","https://github.com/sebastianbergmann/phpunit/pull/1955","https://github.com/sebastianbergmann/phpunit/commit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2017-9841.yaml","http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841","https://github.com/advisories/GHSA-r7c9-c69m-rph8"],"source_kind":"github","identifiers":["GHSA-r7c9-c69m-rph8","CVE-2017-9841"],"repository_url":"https://github.com/sebastianbergmann/phpunit","blast_radius":0.0,"created_at":"2022-12-21T16:12:30.285Z","updated_at":"2026-09-28T20:11:25.297Z","epss_percentage":0.99999,"epss_percentile":0.99994,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN2M5LWM2OW0tcnBoOM02Aw","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yN2M5LWM2OW0tcnBoOM02Aw","packages":[{"ecosystem":"packagist","package_name":"phpunit/phpunit","versions":[{"first_patched_version":"5.6.3","vulnerable_version_range":"\u003e= 5.0.10, \u003c 5.6.3"},{"first_patched_version":"4.8.28","vulnerable_version_range":"\u003e= 4.8.19, \u003c 4.8.28"}],"purl":null}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN2M5LWM2OW0tcnBoOM02Aw/related_packages","related_advisories":[]}]