CVE-2026-41570

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41570", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-21T14:15:21.957Z", "datePublished": "2026-05-08T14:33:51.630Z", "dateUpdated": "2026-05-08T16:01:51.929Z"}, "containers": {"cna": {"title": "PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes", "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "lang": "en", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-88", "lang": "en", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243"}, {"name": "https://github.com/sebastianbergmann/phpunit/pull/6592", "tags": ["x_refsource_MISC"], "url": "https://github.com/sebastianbergmann/phpunit/pull/6592"}], "affected": [{"vendor": "sebastianbergmann", "product": "phpunit", "versions": [{"version": "= 12.5.21", "status": "affected"}, {"version": "= 13.1.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T14:33:51.630Z"}, "descriptions": [{"lang": "en", "value": "PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets \" as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6."}], "source": {"advisory": "GHSA-qrr6-mg7r-m243", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/sebastianbergmann/phpunit/pull/6592", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T16:01:31.346640Z", "id": "CVE-2026-41570", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T16:01:51.929Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41570", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T16:01:31.346640Z"}}}], "references": [{"url": "https://github.com/sebastianbergmann/phpunit/pull/6592", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T16:01:48.319Z"}}], "cna": {"title": "PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes", "source": {"advisory": "GHSA-qrr6-mg7r-m243", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "sebastianbergmann", "product": "phpunit", "versions": [{"status": "affected", "version": "= 12.5.21"}, {"status": "affected", "version": "= 13.1.5"}]}], "references": [{"url": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243", "name": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sebastianbergmann/phpunit/pull/6592", "name": "https://github.com/sebastianbergmann/phpunit/pull/6592", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets \" as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T14:33:51.630Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41570", "state": "PUBLISHED", "dateUpdated": "2026-05-08T16:01:51.929Z", "dateReserved": "2026-04-21T14:15:21.957Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T14:33:51.630Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "phpunit", "vendor": "sebastianbergmann", "versions": [{"status": "affected", "version": "= 12.5.21"}, {"status": "affected", "version": "= 13.1.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpunit_project:phpunit:12.5.21:*:*:*:*:-:*:*", "matchCriteriaId": "14399E6E-3DD0-4CD6-8D89-8C5A99034AE6", "vulnerable": true}, {"criteria": "cpe:2.3:a:phpunit_project:phpunit:13.1.5:*:*:*:*:-:*:*", "matchCriteriaId": "7948E33A-A79E-405B-AE5A-3CB710478DB9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets \" as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6."}, {"lang": "es", "value": "PHPUnit es un framework de pruebas para PHP. En las versiones 12.5.21 y 13.1.5, PHPUnit reenv\u00eda la configuraci\u00f3n INI de PHP a procesos hijo (utilizados para la ejecuci\u00f3n de pruebas aisladas/PHPT) como argumentos de l\u00ednea de comandos -d nombre=valor sin neutralizar los metacaracteres INI. Debido a que el analizador INI de PHP interpreta \u2019 como un delimitador de cadena, ; como el inicio de un comentario, y lo m\u00e1s importante, un salto de l\u00ednea como un separador de directivas, un valor que contiene un salto de l\u00ednea es analizado por el proceso hijo como m\u00faltiples directivas INI. Un atacante capaz de influir en un \u00fanico valor INI puede, por lo tanto, inyectar directivas adicionales arbitrarias en la configuraci\u00f3n del hijo, incluyendo auto_prepend_file, extensi\u00f3n, disable_functions, open_basedir, y otras. Establecer auto_prepend_file a una ruta controlada por el atacante produce ejecuci\u00f3n remota de c\u00f3digo en el proceso hijo. Este problema ha sido parcheado en las versiones 12.5.22 y 13.1.6."}], "id": "CVE-2026-41570", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41570", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T16:01:31.346640Z", "version": "2.0.3"}}]}, "published": "2026-05-08T15:16:40.420", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/sebastianbergmann/phpunit/pull/6592"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "url": "https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/sebastianbergmann/phpunit/pull/6592"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}, {"lang": "en", "value": "CWE-93"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "12.5.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "13.1.5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "phpunit", "source": "cna", "vendor": "sebastianbergmann"}, "product": "phpunit", "vendor": "sebastianbergmann"}], "created": "2026-05-08T16:15:12.460966+00:00", "updated": "2026-05-08T16:45:13.005016+00:00", "vendors": ["sebastianbergmann", "sebastianbergmann$PRODUCT$phpunit"]}