Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
GitHub - Jvr2022/CVE-2026-46420: Proof of Concept for CVE-2026-46420: Command Injection vulnerability in setup-php (versions >= 2.25.0, < 2.37.1). https://github.com/Jvr2022/CVE-2026-46420
Post summary
A GitHub repository offers a proof‑of‑concept and exploit code for CVE‑2026‑46420, a command injection flaw in setup‑php between versions 2.25.0 and 2.37.1, with no active exploitation or patch details cited.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | shivammathur | setup_php | - | - | - |