A security vulnerability, tracked as CVE-2026-46420, has been identified in setup-php, a common tool used with GitHub Actions to automatically configure PHP (the programming language that powers most websites and web apps) for project workflows. The tool handles tasks like installing PHP extensions, adjusting PHP settings, setting up code coverage tools, and adding related utilities for development and deployment. The flaw affects versions 2.25.0 up to (but not including) 2.37.1 of setup-php. The tool reads PHP version settings from files stored in your project repository, but does not properly validate these values before adding them to the setup scripts it generates. If you use GitHub Actions workflows that pull in code from untrusted external sources (such as the pull_request_target workflow type, which processes public pull requests from unknown contributors) before running setup-php, an attacker could modify these repository files to inject harmful commands that would execute on your workflow runner. This vulnerability is fully resolved in setup-php version 2.37.1. If you use this tool as part of your project’s automated workflows, updating to version 2.37.1 or a later release will address the risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46420
