Eval injection in PHPCSUtils array key handling allows code execution
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-95.
Summary
PHPCSUtils from 1.0.0-alpha1 before 1.2.3 evaluates array key expressions with eval() in the getActualArrayKey() method. Attacker-controlled callback-form keys in untrusted PHP code are executed as code, which is CWE-95. A local attacker needs a user to scan the crafted PHP code with an extending sniff, and the attacker can then run arbitrary commands on the scanning host.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PHPCSStandards | PHPCSUtils | 1.0.0-alpha1 – 1.2.2 | — | No fix listed | CNA |
| — | phpcsstandards/phpcsutils (Packagist) | 1.0.0-alpha1 to before 1.2.3 | 1.2.3 | Patch available | GHSA-r6hr-vr92-vv28 |
- PHPCSUtils VendorPHPCSStandards Affected 1.0.0-alpha1 – 1.2.2 Fixed in — No fix listed CNA
- phpcsstandards/phpcsutils (Packagist) Vendor— Affected 1.0.0-alpha1 to before 1.2.3 Fixed in 1.2.3 Patch available GHSA-r6hr-vr92-vv28
Remediation
Upgrade the phpcsstandards/phpcsutils package on Packagist to version 1.2.3, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · GHSA-r6hr-vr92-vv28 phpcsstandards/phpcsutils (Packagist) Fixed in 1.2.3 Advisory →
Timeline
- 2026-10-12 Threatist record created from CVE-2026-65954
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-10-13 CISA SSVC decision points changed
References
Other 7
- https://github.com/PHPCSStandards/PHPCSUtils/security/advisories/GHSA-r6hr-vr92-vv28
- https://github.com/PHPCSStandards/PHPCSUtils/commit/e8648633ff5b8219b1b3e6346ce85abfc30f1429
- https://github.com/PHPCSStandards/PHPCSUtils/releases/tag/1.2.3
- https://github.com/PHPCSStandards/PHPCSUtils/pull/778
- https://github.com/PHPCSStandards/PHPCSUtils/commit/9f596b50ea4498ea57b8cb341e920233b044debf
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpcsstandards/phpcsutils/CVE-2026-65954.yaml
- https://github.com/PHPCSStandards/PHPCSUtils
More PHPCSStandards vulnerabilities
- TI-2026-47714 PHP_CodeSniffer gitblame report command injection via crafted filename CVSS 4.0HIGH 7.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences