PHPCSUtils versions from 1.0.0-alpha1 up to but not including 1.2.3 have an arbitrary code execution vulnerability (CVE-2026-65954) in the method AbstractArrayDeclarationSniff::getActualArrayKey(). The method uses eval() to determine array key values, which can be exploited by maliciously crafted array keys such as 'system('id')' to execute arbitrary commands on the scanning host. This vulnerability can be triggered by running PHPCS with sniffs that extend AbstractArrayDeclarationSniff, including PHPCSExtra sniffs Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. The vulnerability is fixed in PHPCSUtils version 1.2.3. Users are advised to upgrade to 1.2.3 or later. As a workaround, disabling the vulnerable sniffs in the ruleset can mitigate the risk until an upgrade is possible.

Exploitation of this vulnerability allows an attacker to execute arbitrary code on the host machine running PHPCS, potentially leading to full compromise of that system. This can occur when scanning untrusted PHP code, such as in CI pipelines or developer environments. The vulnerability affects the confidentiality, integrity, and availability of the scanning host, as indicated by the CVSS score of 8.6 with high impact on all three security properties.

A patch is available in PHPCSUtils version 1.2.3 that fixes this vulnerability. Users should upgrade to version 1.2.3 or later to remediate the issue. For users who cannot upgrade immediately, the vendor recommends disabling the vulnerable sniffs that call getActualArrayKey() by excluding them in the PHPCS ruleset configuration. For example, exclude Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes sniffs. Verification of exclusion can be done using the 'phpcs -e' command with the custom ruleset. No other mitigation steps are specified by the vendor.