What is the CVSS score of CVE-2026-41570?

CVE-2026-41570 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHPUnit are affected by CVE-2026-41570?

PHPUnit versions 12.5.21 and 13.1.5 contain an arbitrary code execution vulnerability that allows local attackers with write access to phpunit.xml to inject malicious PHP directives into child test…. A patch is available.

How to fix or mitigate CVE-2026-41570?

Within 24 hours: Identify all systems running PHPUnit 12.5.21 or 13.1.5 and assess exposure in CI/CD environments. Within 7 days: Upgrade PHPUnit to version 12.5.22 or 13.1.6 respectively; restrict write access to phpunit.xml files to authorized developers only; implement code review requirements for all phpunit.xml changes. Within 30 days: Audit CI/CD pipeline configurations to enforce repository isolation for untrusted pull requests and implement signed commits for configuration files.

PHPUnit CVE-2026-41570

EUVD-2026-28649 HIGH

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-05-08 GitHub_M

GHSA-qrr6-mg7r-m243

PHP RCE Suse

7.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 08, 2026 - 16:15 vuln.today

Analysis Generated

May 08, 2026 - 16:15 vuln.today

CVE Published

May 08, 2026 - 14:33 nvd

HIGH 7.8

DescriptionGitHub Advisory

PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.

AnalysisAI

Arbitrary PHP directive injection in PHPUnit 12.5.21 and 13.1.5 enables local attackers with write access to phpunit.xml to achieve code execution in isolated test child processes by embedding newlines in INI setting values. The vulnerability exploits PHPUnit's unsanitized forwarding of INI settings to child processes via command-line arguments, where PHP's INI parser treats newlines as directive separators, allowing injection of auto_prepend_file to load attacker-controlled code. Fixed in versions 12.5.22 and 13.1.6. Primary exposure vector is Poisoned Pipeline Execution (PPE) in CI/CD environments running PHPUnit against untrusted pull requests without isolation.

Technical ContextAI

PHPUnit's JobRunner::settingsToParameters() method forwards PHP INI configuration to child processes (used for --process-isolation and PHPT tests) by constructing command-line arguments in the format -d name=value. The method previously passed these values without neutralizing PHP INI metacharacters. PHP's INI parser treats newline (\n) as a directive separator, semicolon (;) as comment start, and double-quote (") as string delimiter. An attacker embedding a newline in an INI value can inject additional directives like auto_prepend_file=/tmp/evil.php, which PHP executes before the test script. This is an instance of CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers / Argument Injection). INI values can originate from <ini name="..." value="..."/> elements in phpunit.xml configuration files or be inherited from the parent PHP runtime via ini_get_all(). The fix adds validation to reject values containing \n or \r and quotes values containing ; or " to prevent parser interpretation.

RemediationAI

Upgrade PHPUnit to patched version 12.5.22 (for 12.x branch) or 13.1.6 (for 13.x branch) via Composer: composer update phpunit/phpunit. The fix implemented in pull request #6592 (https://github.com/sebastianbergmann/phpunit/pull/6592) adds validation in JobRunner::settingsToParameters() to throw PhpProcessException when INI values contain newline or carriage return characters, and quotes values containing semicolons or double-quotes to neutralize their metacharacter interpretation. If immediate patching is not feasible, implement compensating controls: (1) Enable branch protection requiring administrator review of phpunit.xml changes before CI execution, (2) Run PHPUnit in isolated containers/VMs with read-only filesystem mounts for configuration, preventing auto_prepend_file from loading writable paths, (3) Configure CI to execute tests from trusted branches only, rejecting direct execution of untrusted PR code, (4) Audit phpunit.xml and phpunit.xml.dist for existing INI values containing embedded newlines or suspicious directives. Note that disabling --process-isolation completely eliminates the vulnerable code path but breaks test isolation guarantees and PHPT test execution. Official advisory available at https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243.