A security flaw has been identified in setup-php, a common tool used to configure PHP for automated project workflows run on GitHub's Actions system. The flaw impacts all versions of the tool from 2.25.0 up to (but not including) 2.37.1.
This tool pulls PHP version details from files stored in a project's code repository, including .php-version, composer.lock, and composer.json, without properly validating those values before building the setup commands it runs. If your website or project uses workflows that run code from pull requests submitted by external contributors (a standard setup for public or team collaboration projects), an attacker could modify those repository files to inject harmful commands that would execute on your workflow system.
The vulnerability is fully fixed in setup-php version 2.37.1, which adds proper checks for these version values to block this type of command injection attack.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46420
