Improper Neutralization of Argument Delimiters in a Command in PHPUnit - CVE-2026-41570
Published: April 17, 2026
Vulnerability identifier: #VU126453
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41570
CWE-ID: CWE-88
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper neutralization of argument delimiters in PHPUnit\Util\PHP\JobRunner::settingsToParameters() when forwarding PHP INI settings to child processes. A local user can inject a newline-containing INI value to execute arbitrary code.
Exploitation requires control over the content of an INI value read by PHPUnit, such as values from phpunit.xml, the host PHP runtime configuration, or the PHP binary environment.
Affected software
PHPUnit
How to mitigate CVE-2026-41570
Install security update from vendor's website.
PHPUnit - addressed in versions 12.5.22, 13.1.6