CVE-2026-65954CWE-95

CVE-2026-65954

High · published October 12, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00215 · 11.3th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-10-12T23:16Z
References (3)
https://github.com/PHPCSStandards/PHPCSUtils/commit/e8648633ff5b8219b1b3e6346ce85abfc30f1429 · [email protected]https://github.com/PHPCSStandards/PHPCSUtils/releases/tag/1.2.3 · [email protected]https://github.com/PHPCSStandards/PHPCSUtils/security/advisories/GHSA-r6hr-vr92-vv28 · [email protected]
EPSS history
Timeline
  • 14 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 12 OCT 18:51Z
    PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
    cvelistv5
  • 12 OCT 18:51Z
    PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
    cvelistv5