CVE-2026-46420 is a command injection in shivammathur/setup-php, the GitHub Action that installs PHP on a runner. Versions 2.25.0 up to before 2.37.1 are affected. It is rated CVSS 5.6 (medium). The fix is 2.37.1, and workflows that pin an exact release should move to it.
What's affected
The affected range is setup-php from 2.25.0 to before 2.37.1. The patched version is 2.37.1.
The action reads the PHP version from repository files: .php-version, composer.lock (through platform-overrides.php), and composer.json (through config.platform.php). The record says those values were not constrained enough before they went into generated shell or PowerShell setup scripts.
The risk appears when a workflow checks out attacker-controlled content first, then runs setup-php. The advisory's main example is a pull_request_target workflow that checks out untrusted pull request code before calling the action.
The advisory tells users of shivammathur/setup-php@v2 that no action is needed. Users who pin a specific release or commit SHA should upgrade to 2.37.1 or later.
How to check if you're exposed
Search your repositories for workflows that call the action:
grep -rn "shivammathur/setup-php" .github/workflows
Then look at each match:
- Note the ref after the @ sign. A moving tag like v2 receives the fix. An exact version or SHA below 2.37.1 does not.
- Check the trigger. Workflows using pull_request_target, or other triggers that run with secrets in a trusted context, need the closest look.
- Check whether the job checks out code from a fork or pull request head before the setup step.
- Check whether the job has write permissions or secrets available.
What to do now
- Update every pinned reference to 2.37.1 or later. If you pin by SHA, use the SHA of the fixed release.
- In pull_request_target workflows, avoid checking out untrusted pull request code before privileged steps. The advisory does not list this as a workaround, so treat it as general hygiene.
- Set minimal permissions on the workflow token.
- Review recent runs of exposed workflows for unexpected steps or network calls.
- Add a check in review that flags new use of pull_request_target together with a checkout of the pull request head.
Why it matters
The class is CWE-78, OS command injection. Here the input is not a form field but a repository file, which makes the injection easy to overlook. A value that looks like a PHP version becomes part of a script.
CI runners often hold deploy tokens and secrets. That is why a medium score still deserves attention for the narrow case of privileged workflows reading untrusted files. The vector has high attack complexity, which reflects the need for a specific workflow setup. The record's KEV flag is false.
Try it yourself
Gating pull requests is the control that limits this kind of risk. This demo shows how a pull request check fits into a pipeline.
Click through it at your own pace, or open it full screen.
Quick check
I use setup-php@v2. Am I affected?
The advisory says users of the v2 tag need to take no action. Only pinned versions or SHAs older than 2.37.1 need an update.
Does this affect every workflow that uses setup-php?
No. The advisory ties the risk to workflows that check out attacker-controlled contents in a trusted context before running the action.
Sources
Last reviewed: 19 October 2026.
