Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-65954 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:8.6 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/PHPCSStandards/PHPCSUtils/commit/e8648633ff5b8219b1b3e6346ce85abfc30f1429	[email protected]	Source CodeVendor
https://github.com/PHPCSStandards/PHPCSUtils/releases/tag/1.2.3	[email protected]	Release NotesVendor
https://github.com/PHPCSStandards/PHPCSUtils/security/advisories/GHSA-r6hr-vr92-vv28	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-95	Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')	[email protected]

Affected Products

Product	Versions
PHPCSStandards PHPCSUtils	>= 1.0.0-alpha1, < 1.2.3 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.2.3moderate effort Workaround:low effort Disable the vulnerable sniffs by adding `<exclude>` tags to your custom ruleset: ```xml <rule ref="Standard"> <exclude name="Standard.Category.SniffName"/> </rule> ``` For example, to disable the two PHPCSExtra sniffs: ```xml <rule ref="Universal"> <exclude name="Universal.Arrays.DuplicateArrayKey"/> <exclude name="Universal.Arrays.MixedArrayKeyTypes"/> </rule> ``` Verify that the sniffs have been disabled by running PHPCS with the `-e` flag: ``` phpcs -e --standard=/path/to/ruleset.xml ```

Product

Versions

PHPCSStandards PHPCSUtils

>= 1.0.0-alpha1, < 1.2.3 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 1.2.3moderate effort
Workaround:low effort
Disable the vulnerable sniffs by adding `<exclude>` tags to your custom ruleset: ```xml <rule ref="Standard"> <exclude name="Standard.Category.SniffName"/> </rule> ``` For example, to disable the two PHPCSExtra sniffs: ```xml <rule ref="Universal"> <exclude name="Universal.Arrays.DuplicateArrayKey"/> <exclude name="Universal.Arrays.MixedArrayKeyTypes"/> </rule> ``` Verify that the sniffs have been disabled by running PHPCS with the `-e` flag: ``` phpcs -e --standard=/path/to/ruleset.xml ```

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 13, 2026	CVE Modified	CISA-ADP
Oct 12, 2026	New CVE Received	[email protected]