Improper Neutralization of Argument Delimiters in a Command in PHPUnit - #VU126453
Published: April 17, 2026
Vulnerability identifier: #VU126453
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-88
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: sebastianbergmann
Affected software:
PHPUnit
PHPUnit
Detailed vulnerability description
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper neutralization of argument delimiters in PHPUnit\Util\PHP\JobRunner::settingsToParameters() when forwarding PHP INI settings to child processes. A local user can inject a newline-containing INI value to execute arbitrary code.
Exploitation requires control over the content of an INI value read by PHPUnit, such as values from phpunit.xml, the host PHP runtime configuration, or the PHP binary environment.
Remediation
Install security update from vendor's website.