Is phpunit/phpunit 13.1 vulnerable?

Composer · 15 releases from 13.1.0 to 13.1.14 · latest phpunit/phpunit is 13.4.6 · checked 2 Nov 2026

No known advisories in the last release

phpunit/phpunit 13.1.14, the last 13.1 release, has no known advisories. 2 advisories affect earlier 13.1.x releases, so update to 13.1.14.

Update within 13.1:composer require phpunit/phpunit:^13.1.14

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 13.1.x, affecting earlier releases

  • HighGHSA-mh6w-vxff-9wqp22 Apr 2026

    PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes

    Affected
    >=12.5.21 <12.5.22 · >=13.1.5 <13.1.6
    Fixed in
    12.5.22, 13.1.6
  • HighCVE-2026-41570GHSA-qrr6-mg7r-m24318 Apr 2026

    PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

    Affected
    >=12.5.21 <12.5.22 · >=13.1.5 <13.1.6
    Fixed in
    12.5.22, 13.1.6

Which of your client projects are still on phpunit/phpunit 13.1?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact phpunit/phpunit version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other phpunit/phpunit versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.