{"answers":{"affected":"1 open source package ship an affected version, including shivammathur/setup-php.","exploited":"There is no known exploitation of GHSA-5wxr-w449-57cm in the wild and no public exploit code.","fix":"Upgrade shivammathur/setup-php to 2.37.1 or later.","what":"GHSA-5wxr-w449-57cm is a vulnerability in shivammathur/setup-php, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-5wxr-w449-57cm and fix it if it is affected.\n\nWhat it is: GHSA-5wxr-w449-57cm is a vulnerability in shivammathur/setup-php, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-5wxr-w449-57cm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- shivammathur/setup-php (GitHub Actions): affected all versions; fixed in 2.37.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-5wxr-w449-57cm/ (Markdown: https://insights.sbomify.com/GHSA-5wxr-w449-57cm/index.md)","id":"GHSA-5wxr-w449-57cm","markdown":"https://insights.sbomify.com/GHSA-5wxr-w449-57cm/index.md","name":"GHSA-5wxr-w449-57cm","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"GitHub Actions setup-php","requires_auth":"none","summary":"Attackers can read GitHub tokens from public logs if setup-php pins vulnerable Composer versions, potentially leading to unauthorized repository access.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nThis affects only workflows that pin an exact affected Composer semver version through setup-php, for example `tools: composer:2.9.7`.\n\nWorkflows using the default Composer version, `composer:v2`, or no pinned Composer version are not affected through setup-php, because those Composer URLs have been updated to patched Composer releases for all setup-php versions.\n\nsetup-php does not directly print the token. The token may be exposed through Composer when Composer validates github-oauth auth and rejects GitHub's newer hyphen-containing token format.\n\nPublic repository logs may expose the token. GitHub-hosted runner GITHUB_TOKEN values expire after the job, but exposure may still matter during the token lifetime and for longer-lived GitHub App or user tokens.\n\n### Patches\nsetup-php 2.37.1 skips generated GitHub OAuth auth for pinned Composer versions affected by Composer GHSA-f9f8-rm49-7jv2 while preserving other Composer auth, including Packagist auth.\n\n### Workarounds\nUpgrade to setup-php `2.37.1` or newer. You can also avoid the affected path by using a patched Composer version: 2.9.8, 2.2.28, 1.10.28, or newer supported Composer releases.\n\nIt is recommended to avoid pinning affected Composer versions such as `composer:2.9.7`, unless you have automations to do timely updates in your workflows.","ecosystems":["GitHub Actions"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","id":"GHSA-5wxr-w449-57cm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"GitHub Actions","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"GitHub Actions","fixed":["2.37.1"],"introduced":["0"],"last_affected":[],"package":"shivammathur/setup-php","purl":null,"source":"GHSA-5wxr-w449-57cm"}],"products":null,"published":"2026-05-20","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can read GitHub tokens from public logs if setup-php pins vulnerable Composer versions, potentially leading to unauthorized repository access.","url":"https://insights.sbomify.com/GHSA-5wxr-w449-57cm/"}