CVE-2026-65954

HighCVSS 8.6/10Last modified Oct 16, 2026

Description

PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-95

Affected software

Vendor	Product	Versions
PHPCSStandards	PHPCSUtils	>= 1.0.0-alpha1, <= 1.2.2

References

Timeline

Published: Oct 12, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-6595610.0KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are expos CVE-2026-659576.9Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:CVE-2026-659595.3Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHt CVE-2026-65967.3A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function create_upload_file of the file src/CVE-2026-659608.8Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes CVE-2026-659658.7ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the c CVE-2026-659677.1Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability CVE-2026-659685.3ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the CVE-2026-659695.5OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3 CVE-2026-65972.7A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/b CVE-2026-659705.3OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3 CVE-2026-659717.6Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire p