phpcsstandards/phpcsutils

Version	Released
`1.2.3` patch	Jul 27, 2026
`1.2.2` patch 1 CVE	Dec 08, 2025
`1.2.1` patch 1 CVE	Nov 17, 2025
`1.2.0` minor 1 CVE	Nov 11, 2025
`1.1.3` patch 1 CVE	Oct 16, 2025
`1.1.2` patch 1 CVE	Sep 05, 2025
`1.1.1` patch 1 CVE	Aug 10, 2025
`1.1.0` minor 1 CVE	Jun 12, 2025
`1.0.12` patch 1 CVE	May 20, 2024
`1.0.11` patch 1 CVE	Apr 24, 2024
`1.0.10` patch 1 CVE	Mar 17, 2024
`1.0.9` patch 1 CVE	Dec 08, 2023
`1.0.8` patch 1 CVE	Jul 16, 2023
`1.0.7` patch 1 CVE	Jul 10, 2023
`1.0.6` patch 1 CVE	May 27, 2023
`1.0.5` patch 1 CVE	Apr 17, 2023
`1.0.4` patch 1 CVE	Apr 15, 2023
`1.0.3` patch 1 CVE	Apr 13, 2023
`1.0.2` patch 1 CVE	Mar 28, 2023
`1.0.1` patch 1 CVE	Jan 05, 2023
`1.0.0` initial 1 CVE	Jan 03, 2023
`1.0.0-rc1` pre 1 CVE	Dec 27, 2022
`1.0.0-alpha4` pre 1 CVE	Oct 25, 2022
`1.0.0-alpha3` pre 1 CVE	Jun 28, 2020
`1.0.0-alpha2` pre 1 CVE	Feb 16, 2020
`1.0.0-alpha1` pre 1 CVE	Jan 23, 2020

1.2.3 patch

Jul 27, 2026

1.2.2 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Dec 08, 2025

1.2.1 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Nov 17, 2025

1.2.0 minor

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Nov 11, 2025

1.1.3 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Oct 16, 2025

1.1.2 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Sep 05, 2025

1.1.1 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Aug 10, 2025

1.1.0 minor

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Jun 12, 2025

1.0.12 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

May 20, 2024

1.0.11 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Apr 24, 2024

1.0.10 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Mar 17, 2024

1.0.9 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Dec 08, 2023

1.0.8 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Jul 16, 2023

1.0.7 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Jul 10, 2023

1.0.6 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

May 27, 2023

1.0.5 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Apr 17, 2023

1.0.4 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Apr 15, 2023

1.0.3 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Apr 13, 2023

1.0.2 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Mar 28, 2023

1.0.1 patch

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Jan 05, 2023

1.0.0 initial

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Jan 03, 2023

1.0.0-rc1 pre

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Dec 27, 2022

1.0.0-alpha4 pre

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Oct 25, 2022

1.0.0-alpha3 pre

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Jun 28, 2020

1.0.0-alpha2 pre

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Feb 16, 2020

1.0.0-alpha1 pre

1 CVE

CVE-2026-65954 GHSA-r6hr-vr92-vv28 Sep 29, 2026

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

8.6 / 10

High

Local Low None Required Changed High High High

Impact

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey(). The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls getActualArrayKey().

Running PHPCS over untrusted PHP code through such a sniff, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host.

The vulnerability happens when the method determines the value of an array key using eval(). A maliciously crafted array key such as 'system'('id') would be executed when the code was scanned.

Known attack vectors

Known code paths that reach the vulnerable method include the following PHPCSExtra sniffs:

Universal.Arrays.DuplicateArrayKey
Universal.Arrays.MixedArrayKeyTypes

Other packages that call AbstractArrayDeclarationSniff::getActualArrayKey() may also be vulnerable.

Patches

This issue has been fixed in PHPCSUtils 1.2.3. We recommend all users upgrade to 1.2.3 or later.

Workaround

Users who cannot upgrade immediately can disable the sniffs that reach the vulnerable method by adding <exclude> tags to their custom ruleset (replace the placeholder standard and sniff names with the ones used in your setup):

<rule ref="Standard">
	<exclude name="Standard.Category.SniffName"/>
</rule>

For example, to disable the two PHPCSExtra sniffs listed under "Known attack vectors":

<rule ref="Universal">
	<exclude name="Universal.Arrays.DuplicateArrayKey"/>
	<exclude name="Universal.Arrays.MixedArrayKeyTypes"/>
</rule>

To verify that the sniffs have been disabled, run PHPCS with the -e flag, which lists all the sniffs a standard will run. The excluded sniffs should no longer appear in the output:

phpcs -e --standard=/path/to/ruleset.xml

Credits

Many thanks to @rodrigoprimo for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHPCSUtils repository.

Affected versions


          1.0.0


          1.0.0-alpha1


          1.0.0-alpha2


          1.0.0-alpha3


          1.0.0-alpha4


          1.0.0-rc1


          1.0.1


          1.0.10


          1.0.11


          1.0.12


          1.0.2


          1.0.3

+ 13 more


            1.0.4


            1.0.5


            1.0.6


            1.0.7


            1.0.8


            1.0.9


            1.1.0


            1.1.1


            1.1.2


            1.1.3


            1.2.0


            1.2.1


            1.2.2

Fixed in


          1.2.3

References

Updated Sep 29, 2026 · Source: OSV.dev

Jan 23, 2020

Activity

Reach

Details