{"answers":{"affected":"1 open source package ship an affected version, including shivammathur/setup-php. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-46420 in the wild and no public exploit code.","fix":"Upgrade shivammathur/setup-php to 2.37.1 or later.","what":"CVE-2026-46420 is a medium-severity command injection vulnerability in shivammathur setup-php, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-46420 and fix it if it is affected.\n\nWhat it is: CVE-2026-46420 is a medium-severity command injection vulnerability in shivammathur setup-php, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-46420 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- shivammathur/setup-php (GitHub Actions): affected from 2.25.0; fixed in 2.37.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-46420/ (Markdown: https://insights.sbomify.com/CVE-2026-46420/index.md)","id":"CVE-2026-46420","markdown":"https://insights.sbomify.com/CVE-2026-46420/index.md","name":"CVE-2026-46420","record":{"aliases":["GHSA-pqwm-q9pv-ph8r"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"GitHub Actions","requires_auth":"none","summary":"Attackers can execute arbitrary commands on GitHub Actions runners by manipulating repository files used for PHP version resolution in setup-php.","user_interaction":"not_required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"setup_php","vendor":"shivammathur"}],"cvss":{"score":5.6,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"description":"setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.","ecosystems":["GitHub Actions"],"exploits":{"exploitdb":0,"first_seen":"2026-07-18","github_poc":1,"max_poc_stars":1,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-07-18T22:27:39Z","kind":"github_poc","ref":"https://github.com/Jvr2022/CVE-2026-46420","stars":1,"title":"PoC for CVE-2026-46420, command injection in shivammathur/setup-php via repository-controlled PHP version resolution."}],"tier":"poc_unverified"},"has_fix":true,"headline":"setup-php: Command Injection in Repository-Derived PHP Version Resolution","id":"CVE-2026-46420","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"GitHub Actions","product":null,"products":[],"type":"command_injection","year":"2026"},"n_packages":1,"n_references":3,"next":{"headline":"Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)","id":"CVE-2026-46421"},"packages":[{"ecosystem":"GitHub Actions","fixed":["2.37.1"],"introduced":["2.25.0"],"last_affected":[],"package":"shivammathur/setup-php","purl":null,"source":"GHSA-pqwm-q9pv-ph8r"}],"prev":{"headline":"Auth bypass in webauthn-server-core","id":"CVE-2026-46419"},"products":["setup-php"],"published":"2026-07-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-20","vendors":["shivammathur"]},"summary":"Attackers can execute arbitrary commands on GitHub Actions runners by manipulating repository files used for PHP version resolution in setup-php.","url":"https://insights.sbomify.com/CVE-2026-46420/"}