A security vulnerability tracked as CVE-2026-46420 has been identified in setup-php, a common tool used to configure PHP environments for GitHub Actions automated workflows, which are often used for testing and deploying websites. The flaw affects all versions of setup-php from 2.25.0 up to (but not including) version 2.37.1. The tool pulls PHP version information from files in your code repository (such as .php-version, composer.lock, and composer.json) but does not properly validate those values before adding them to generated shell or PowerShell setup scripts.
This gap allows an attacker to inject malicious commands that run on the GitHub Actions runner if your workflow pulls in untrusted content (for example, code from a pull request processed via pull_request_target workflows) before invoking setup-php. For teams that use this tool for website development or deployment workflows, this command injection could let bad actors run arbitrary code on the runner, which may let them access your codebase, steal sensitive secrets stored in your workflow configurations, or make unauthorized changes to your live site.
The vulnerability is fully resolved in setup-php version 2.37.1.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46420
