CVE-2026-41570
1 advisory.
Packagist/phpunit/phpunit CVE-2026-41570: high 7.8, EPSS 0.28%
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
Action: Upgrade phpunit/phpunit to 12.5.22 or later.
composer require phpunit/phpunit:12.5.22composer require phpunit/phpunit:13.1.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.5.21 | 12.5.22 | - |
| 13.1.5 | 13.1.6 | - |
Fixed versions
| 12.5.22 | 13.1.6 |
Sources
- osv: GHSA-qrr6-mg7r-m243
- https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-qrr6-mg7r-m243
- https://nvd.nist.gov/vuln/detail/CVE-2026-41570
- https://github.com/sebastianbergmann/phpunit/pull/6592
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2026-41570.yaml
- https://github.com/sebastianbergmann/phpunit
CVE-2026-41570 · published · modified · JSON