# GHSA-5wxr-w449-57cm: Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions

> Attackers can read GitHub tokens from public logs if setup-php pins vulnerable Composer versions, potentially leading to unauthorized repository access.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 20 May 2026

## What is GHSA-5wxr-w449-57cm?

GHSA-5wxr-w449-57cm is a vulnerability in shivammathur/setup-php, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Impact
This affects only workflows that pin an exact affected Composer semver version through setup-php, for example `tools: composer:2.9.7`.

Workflows using the default Composer version, `composer:v2`, or no pinned Composer version are not affected through setup-php, because those Composer URLs have been updated to patched Composer releases for all setup-php versions.

setup-php does not directly print the token. The token may be exposed through Composer when Composer validates github-oauth auth and rejects GitHub's newer hyphen-containing token format.

Public repository logs may expose the token. GitHub-hosted runner GITHUB_TOKEN values expire after the job, but exposure may still matter during the token lifetime and for longer-lived GitHub App or user tokens.

### Patches
setup-php 2.37.1 skips generated GitHub OAuth auth for pinned Composer versions affected by Composer GHSA-f9f8-rm49-7jv2 while preserving other Composer auth, including Packagist auth.

### Workarounds
Upgrade to setup-php `2.37.1` or newer. You can also avoid the affected path by using a patched Composer version: 2.9.8, 2.2.28, 1.10.28, or newer supported Composer releases.

It is recommended to avoid pinning affected Composer versions such as `composer:2.9.7`, unless you have automations to do timely updates in your workflows.

## Which versions are affected by GHSA-5wxr-w449-57cm?

1 open source package ship an affected version, including shivammathur/setup-php.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `shivammathur/setup-php` | GitHub Actions | All versions | 2.37.1 |

## How do I fix GHSA-5wxr-w449-57cm?

Upgrade shivammathur/setup-php to 2.37.1 or later.

## Is GHSA-5wxr-w449-57cm being exploited?

There is no known exploitation of GHSA-5wxr-w449-57cm in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-5wxr-w449-57cm and fix it if it is affected.

What it is: GHSA-5wxr-w449-57cm is a vulnerability in shivammathur/setup-php, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-5wxr-w449-57cm in the wild and no public exploit code.

Affected packages and fixed versions:
- shivammathur/setup-php (GitHub Actions): affected all versions; fixed in 2.37.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-5wxr-w449-57cm/ (Markdown: https://insights.sbomify.com/GHSA-5wxr-w449-57cm/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-5wxr-w449-57cm

---
From sbomify Insights: https://insights.sbomify.com/GHSA-5wxr-w449-57cm/
Summaries are generated and may contain mistakes; the official description above is the record.