SB2026041795 - Improper Neutralization of Argument Delimiters in a Command in PHPUnit
Published: April 17, 2026
Security Bulletin ID
SB2026041795
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: N/A)
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper neutralization of argument delimiters in PHPUnit\Util\PHP\JobRunner::settingsToParameters() when forwarding PHP INI settings to child processes. A local user can inject a newline-containing INI value to execute arbitrary code.
Exploitation requires control over the content of an INI value read by PHPUnit, such as values from phpunit.xml, the host PHP runtime configuration, or the PHP binary environment.
Remediation
Install update from vendor's website.