CVE-2026-41570: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') in sebastianbergmann phpunit
PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.
AI Analysis
Technical Summary
PHPUnit versions 12.5.21 and 13.1.5 forward PHP INI settings to child processes as -d name=value command-line arguments without properly neutralizing INI metacharacters such as newline characters. Because PHP's INI parser treats newlines as directive separators, an attacker able to control a single INI value can inject arbitrary additional INI directives. This includes critical directives like auto_prepend_file, which can be set to an attacker-controlled path, resulting in remote code execution within the child process. The vulnerability is classified under CWE-93 (Improper Neutralization of CRLF Sequences) and CWE-88. It has a CVSS v3.1 score of 7.8 (high severity). The issue is fixed in PHPUnit versions 12.5.22 and 13.1.6.
Potential Impact
An attacker with the ability to influence a single PHP INI value in affected PHPUnit versions can inject arbitrary INI directives into child processes. This can lead to remote code execution by setting directives such as auto_prepend_file to malicious files. The vulnerability affects confidentiality, integrity, and availability of the affected system, as reflected by the CVSS score of 7.8. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available: users should upgrade PHPUnit to versions 12.5.22 or 13.1.6 or later. These versions properly neutralize INI metacharacters and prevent CRLF injection. Until upgraded, avoid running untrusted code or tests that could influence INI settings. Patch status is confirmed by the vendor advisory indicating the issue is resolved in the specified versions.
CVE-2026-41570: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') in sebastianbergmann phpunit
Description
PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as multiple INI directives. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including auto_prepend_file, extension, disable_functions, open_basedir, and others. Setting auto_prepend_file to an attacker-controlled path yields remote code execution in the child process. This issue has been patched in versions 12.5.22 and 13.1.6.
CVSS v3.1
Score 7.8high
Affected software
pkg:github/sebastianbergmann/phpunitRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PHPUnit versions 12.5.21 and 13.1.5 forward PHP INI settings to child processes as -d name=value command-line arguments without properly neutralizing INI metacharacters such as newline characters. Because PHP's INI parser treats newlines as directive separators, an attacker able to control a single INI value can inject arbitrary additional INI directives. This includes critical directives like auto_prepend_file, which can be set to an attacker-controlled path, resulting in remote code execution within the child process. The vulnerability is classified under CWE-93 (Improper Neutralization of CRLF Sequences) and CWE-88. It has a CVSS v3.1 score of 7.8 (high severity). The issue is fixed in PHPUnit versions 12.5.22 and 13.1.6.
Potential Impact
An attacker with the ability to influence a single PHP INI value in affected PHPUnit versions can inject arbitrary INI directives into child processes. This can lead to remote code execution by setting directives such as auto_prepend_file to malicious files. The vulnerability affects confidentiality, integrity, and availability of the affected system, as reflected by the CVSS score of 7.8. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available: users should upgrade PHPUnit to versions 12.5.22 or 13.1.6 or later. These versions properly neutralize INI metacharacters and prevent CRLF injection. Until upgraded, avoid running untrusted code or tests that could influence INI settings. Patch status is confirmed by the vendor advisory indicating the issue is resolved in the specified versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-21T14:15:21.957Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fdf879cbff5d8610e2800b
Added to database: 05/08/2026, 14:51:37 UTC
Last enriched: 05/08/2026, 15:06:28 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.