CVE-2026-65954

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-65954
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65954.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-65954
Aliases
Published
2026-10-12T18:51:01Z
Modified
2026-10-15T02:30:36Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
Details

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-95"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65954.json"
}
References

Affected packages

Git / github.com/phpcsstandards/phpcsutils

Affected ranges

Type
GIT
Repo
https://github.com/phpcsstandards/phpcsutils
Events
Introduced
17c369202671ed42cfb9e653c3a865a68595fac6
Fixed
e8648633ff5b8219b1b3e6346ce85abfc30f1429
Fixed
5f35d9408c54d7b529501f3c688b6eae562aea1f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.0.0-alpha1"
        },
        {
            "last_affected":  "1.2.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.0
1.0.0-alpha1
1.0.0-alpha2
1.0.0-alpha3
1.0.0-alpha4
1.0.0-rc1
1.0.1
1.0.10
1.0.11
1.0.12
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-65954.json"