AIKIDO-2026-148454
phpcsstandards/phpcsutils is vulnerable to Code Injection
86
High Risk
This Affects:
phpcsstandards/phpcsutilsTL;DR
The AbstractArrayDeclarationSniff::getActualArrayKey() method determines an array key's value by assembling a PHP expression from tokens in the code under scan and passing it to eval(). When PHP_CodeSniffer runs a sniff that reaches this method over untrusted code, a crafted array key that looks like a function call is executed on the scanning host, allowing arbitrary command execution. This exposes CI pipelines that lint pull requests and developers reviewing third-party code. The fix bows out when callback or function-call-like token patterns are detected and wraps the eval() call in defensive error handling.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run PHP_CodeSniffer with a sniff that reaches AbstractArrayDeclarationSniff::getActualArrayKey() over untrusted, externally influenced code (for example the PHPCSExtra sniffs Universal.Arrays.DuplicateArrayKey or Universal.Arrays.MixedArrayKeyTypes linting third-party or pull-request source).
Background info
phpcsstandards/phpcsutils is vulnerable to Code Injection in versions 1.0.0 - 1.2.2.
How to fix this
Upgrade the phpcsstandards/phpcsutils library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant