A security vulnerability, tracked as CVE-2026-46420, was found in setup-php, a popular tool developers use to automatically configure PHP (the programming language that runs most websites) for their projects. The flaw affects all versions of the tool from 2.25.0 up to 2.37.0.
The issue occurs when the tool pulls the PHP version to install from files stored in a project’s code repository (such as .php-version, composer.lock, or composer.json) without properly validating those values before adding them to generated setup commands. If a project uses a specific type of automated GitHub Actions workflow that checks out code from external contributors before running the setup-php tool, an attacker could submit a malicious pull request with modified version files to run unauthorized commands on the system running the workflow.
This vulnerability has been resolved in setup-php version 2.37.1. If your development team uses this tool as part of your website’s build or deployment process, updating to the fixed version will address the associated risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46420
