PHPCSUtils: Remote code execution via eval() in array key handling

Summary

PHPCSUtils is a utility library for PHP_CodeSniffer, used in development and CI linting. In versions 1.0.0-alpha1 through 1.2.2, the method AbstractArrayDeclarationSniff::getActualArrayKey() evaluates array key expressions with eval(), so attacker-controlled callback-form keys in PHP code can execute arbitrary commands on the scanning host. The attack requires that a sniff extending this method, such as Universal.Arrays.DuplicateArrayKey or Universal.Arrays.MixedArrayKeyTypes, scans the untrusted code, for example in a CI pipeline linting pull requests or on a developer machine reviewing third-party code.

Affected

• PHPCSUtils 1.0.0-alpha1 up to and including 1.2.2
• Sniffs that extend AbstractArrayDeclarationSniff and call getActualArrayKey(), for example in PHPCSExtra

Fixed in

• Fixed in PHPCSUtils 1.2.3

Workaround

• No workaround is documented by the vendor; the vendor's remedy is the upgrade to 1.2.3.
• Until the upgrade is done, do not scan untrusted PHP code with affected sniffs.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No public proof of concept identified; the issue was coordinated disclosure, credited to a researcher.

Our recommendation

• Update phpcsstandards/phpcsutils to 1.2.3 or later, including indirect dependencies in composer.lock.
• Until then, do not run PHPCS-based linting with affected sniffs over untrusted code, and review CI pipelines that lint external pull requests.
• Audit custom or third-party sniffs that call getActualArrayKey().
• Priority is high for SMEs scanning untrusted code and low for closed environments that only lint their own code.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-r6hr-vr92-vv28 github.com
• PHPCSUtils Release 1.2.3 github.com
• Fix commit e8648633 github.com
• OSV GHSA-r6hr-vr92-vv28 osv.dev
• GitLab Advisory CVE-2026-65954 advisories.gitlab.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:40.