PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
Date: 2026-04
Affected: composer/phpunit/phpunit, composer/phpunit/phpunit
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-41570
CWE: CWE-88
CWE-93
CVSS: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

# Impact PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as `-d name=value` command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets `"` as a string delimiter, `;` as the start of a comment, and most importantly a newline as a directive separator, a value containing a newline is parsed by the child process as **multiple INI directives**. An attacker able to influence a single INI value can therefore inject arbitrary additional directives into the child's configuration, including `auto_prepend_file`, `extension`, `disable_functions`, `open_basedir`, and others. Setting `auto_prepend_file` to an attacker-controlled path yields **remote code execution** in the child process. **Sources of INI values that participate in the attack:** - `<ini name="…" value="…"/>` entries in `phpunit.xml` / `phpunit.xml.dist` - INI settings inherited from the host PHP runtime via `ini_get_all()` ## Threat Model Exploitation requires the attacker to control the content of an INI value read by PHPUnit. In practice this means write access to the project's `phpunit.xml`, the host `php.ini`, or the PHP binary's environment. The most realistic exposure is **Poisoned Pipeline Execution (PPE)**: a pull request from an untrusted contributor that modifies `phpunit.xml` to include a newline-containing INI value, executed by a CI system that runs PHPUnit against the PR without isolation. A malicious newline is not vis


Mitigations:

Architectural layers (MAESTRO):