A security flaw has been found in setup-php, a common tool used to configure PHP environments for automated tasks run via GitHub Actions (a service many teams use for automated workflows like site testing and deployments). The flaw affects all versions of the tool from 2.25.0 up to 2.37.0.
The vulnerability works because the tool reads PHP version details from files stored in your project (including .php-version, composer.lock, and composer.json) and uses those details to build setup commands, but it does not properly check those values for malicious content first. If your GitHub Actions workflows run the setup-php tool after checking out code from untrusted sources (such as pull requests submitted by people outside your team), an attacker could modify those project files to inject unauthorized commands that run on the workflow runner.
This issue is resolved in version 2.37.1 of the setup-php tool.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46420
