CriticalGHSA-r7c9-c69m-rph8CVE-2017-9841
Code Injection in PHPUnit
Published 26 Mar 2022 · Updated 22 Oct 2025
Affected packages
phpunit/phpunitComposer
- Affected
- >=4.8.19 <4.8.28
- Fixed in
- 4.8.28
Update to the fixed version for your release line, for example:
composer require phpunit/phpunit:^4.8.28phpunit/phpunitComposer
- Affected
- >=5.0.10 <5.6.3
- Fixed in
- 5.6.3
Update to the fixed version for your release line, for example:
composer require phpunit/phpunit:^5.6.3Details
Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a <?php substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Is GHSA-r7c9-c69m-rph8 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected phpunit/phpunit, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2017-9841
- Linkgithub.com/sebastianbergmann/phpunit/pull/1955
- Linkgithub.com/sebastianbergmann/phpunit/pull/1956
- Linkgithub.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5
- Linkgithub.com/sebastianbergmann/phpunit/commit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2017-9841.yaml
- Packagegithub.com/sebastianbergmann/phpunit
- Linksecurity.gentoo.org/glsa/201711-15
- Linkwww.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9841
- Linkwww.oracle.com/security-alerts/cpuoct2021.html
- Linkweb.archive.org/web/20170701212357/http://phpunit.vulnbusters.com
- Linkwww.securityfocus.com/bid/101798
- Linkwww.securitytracker.com/id/1039812
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.