CVE-2026-65954
Received Received - Intake

Remote Code Execution in PHPCSUtils via eval() in getActualArrayKey()

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description
PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-65954
EUVD
EUVD-2026-97779

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PHPCSStandards PHPCSUtils >= 1.0.0-alpha1, <= 1.2.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in PHPCSUtils versions 1.0.0-alpha1 to 1.2.2. It involves the method AbstractArrayDeclarationSniff::getActualArrayKey() using eval() to process attacker-controlled array-key expressions. This allows malicious code like function calls in array keys to execute arbitrary commands on the system running the PHP CodeSniffer scan.

Detection Guidance

To detect this vulnerability, check if your system uses PHPCSUtils versions between 1.0.0-alpha1 and 1.2.2. Run: php -r "require 'vendor/autoload.php'; echo PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::VERSION;"

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary commands on your system. This is particularly dangerous in CI pipelines or when scanning third-party code, as it could lead to system compromise, data theft, or service disruption. The high CVSS score of 8.6 reflects its severe potential impact.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Exploitation might result in data breaches, unauthorized access, or system modifications, all of which are compliance violations under these regulations.

Mitigation Strategies

Upgrade PHPCSUtils to version 1.2.3 or later. If immediate upgrade is not possible, exclude vulnerable sniffs like Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes from your PHPCS ruleset using <exclude> tags.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart