Arbitrary Code Execution Vulnerability in PHPCSUtils for PHP_CodeSniffer
CVE-2026-65954
8.6HIGH
What is CVE-2026-65954?
PHPCSUtils, a utility suite designed for PHP_CodeSniffer, contains a vulnerability in the AbstractArrayDeclarationSniff class that permits the evaluation of attacker-controlled array-key expressions using eval(). This flaw allows malicious users to execute arbitrary commands within the context of the scanning host, particularly exploiting callback-form keys in untrusted PHP code scanned. The vulnerable versions span from 1.0.0-alpha1 to 1.2.2, and it has been addressed in version 1.2.3. Users are strongly advised to update to the latest version to mitigate risk.
Affected Version(s)
PHPCSUtils >= 1.0.0-alpha1, <= 1.2.2