phpunit vulnerabilities

2 known vulnerabilities in phpunit from Sebastianbergmann. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  phpunit: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-41570May 8, 2026Sebastianbergmann

  PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for isolated/PHPT test execution) as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's

• 7.8 High severity

  phpunit: Deserialization of Untrusted Data

  CVE-2026-24765Jan 27, 2026Sebastianbergmann

  PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanu