External risk intelligence

GitHub Action setup-php Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-46420

This vulnerability exists within a GitHub Action used in CI/CD build-time pipelines. It is a developer-tooling component executed in isolated build environments, not a product or service deployed to the public internet for external access.

OS Command Injection

Shivammathur Setup Php

2.25.0 to before 2.37.1

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in a GitHub action used for setting up PHP environments. The issue allows for command injection, potentially impacting the integrity of code execution within GitHub Actions workflows.

Input validation flaw in a PHP setup tool.
Affects automated build processes and code integrity.
Confirm relevance and exposure in your CI/CD pipelines.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by controlling files within a repository. When a GitHub Actions workflow checks out this repository and then uses the setup-php GitHub Action, the action might incorporate values from these attacker-controlled files into scripts. If these values are not properly constrained, they could allow an attacker to run arbitrary commands on the GitHub Actions runner.

No specific user interaction needed.
Malicious repository files.
Command execution on runner.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject malicious commands into scripts generated by the `setup-php` GitHub action. This may occur when a workflow, such as a `pull_request_target`, checks out untrusted code before the action is invoked, leading to the execution of arbitrary code on the GitHub Actions runner.

Runner command execution.
Untrusted code checkout before action execution.
Arbitrary command execution on runner.

Operational Fix

Recommended remediation, mitigation, and detection steps

Responsible teams should first identify all GitHub Actions workflows utilizing `setup-php`, confirm their exposure via `pull_request_target` or similar triggers, and then ascertain the business criticality of affected repositories. Coordination with the development or platform engineering teams responsible for CI/CD pipelines will be necessary to plan remediation, which may involve updating the GitHub Action or modifying workflow configurations to mitigate risk.

Identify affected GitHub Action workflows.
Verify workflow triggers and repository criticality.
Update GitHub Action or workflow configurations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is shivammathur/setup-php?

It is a widely used GitHub Action designed to automate the installation and configuration of PHP environments within automated build and testing pipelines. Developers rely on it to quickly set up specific PHP versions, extensions, and tools like composer, ensuring their projects are tested against consistent environments before code is merged or deployed.

What does CVE-2026-46420 mean?

This vulnerability is classified as CWE-78, or OS Command Injection. It occurs when the software takes input—such as PHP version strings from configuration files—and inserts them into shell commands without proper validation. Because the action fails to sanitize these inputs, an attacker can manipulate them to execute unauthorized commands on the machine running the workflow.

How does an attacker trigger this vulnerability?

The flaw is triggered when a workflow, particularly one using pull_request_target, checks out untrusted code containing specifically crafted configuration files like .php-version or composer.json. If the workflow then invokes a vulnerable version of setup-php, the action processes these malicious files as legitimate inputs. Workflows that do not use untrusted input for these specific configuration files are not susceptible to this trigger path.

Is my software affected by this?

According to Halo Surface Signal, this risk is very unlikely to affect public-facing services because the vulnerability exists only within CI/CD build-time pipelines. The impact is restricted to the isolated build runner environment rather than an internet-facing application. However, teams should check if they use affected versions in pipelines that process external pull requests.

How do I secure my workflows?

The primary step is to update the setup-php GitHub Action to version 2.37.1 or later, which includes the necessary input validation fixes. Additionally, review your pipeline configurations to identify where pull_request_target triggers are used. If immediate patching is not possible, consider restricting the permissions of the workflow or the types of code it processes during the build.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.