Skip to content
Heist/ feed
High

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

Type: advisorySource: Official CVE List1 source record

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.

Announced Source revision 1
Original source ↗

CVE-2026-65954

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-65954

PHPCSUtils

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "PHPCSStandards",
    "product": "PHPCSUtils",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.0.0-alpha1, <= 1.2.2"
      }
    ]
  }
]
Related CVEs
CVE-2026-65954

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-65954 · High

phpcsstandards/phpcsutils

Event
#20370 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement