Executive brief
shivammathur/setup-php is a popular GitHub Action used to configure PHP environments for automated software testing and deployment. A security flaw allows attackers to execute unauthorized commands on the build server by placing malicious code inside common configuration files like composer.json or .php-version. This is particularly dangerous for projects that automatically process pull requests from external contributors, as it could lead to the theft of secrets or unauthorized access to the build environment.
Technical details
A command injection vulnerability exists in shivammathur/setup-php versions 2.25.0 through 2.37.0. The action resolves PHP versions from repository files including .php-version, composer.lock, and composer.json without sufficient sanitization. These values are subsequently incorporated into generated shell or PowerShell setup scripts. An attacker can exploit this by submitting a pull request containing a malicious version string in these files. If the workflow (e.g., pull_request_target) checks out the untrusted code before running setup-php, the injected commands will execute on the GitHub Actions runner. The issue is fixed in version 2.37.1 by implementing stricter input validation and hardening script generation.
Affected products
- shivammathur setup-php >= 2.25.0, < 2.37.1
Timeline
- 2026-05-14: patched: Version 2.37.1 released
- 2026-05-14: advisory: GitHub Security Advisory GHSA-pqwm-q9pv-ph8r published
- 2026-07-17: disclosed: CVE-2026-46420 published to NVD