Repository navigation
Security: shivammathur/setup-php
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Command Injection in Repository-Derived PHP Version ResolutionGHSA-pqwm-q9pv-ph8r published
May 14, 2026 by shivammathurModerate -
GitHub tokens configured by setup-php may be exposed through pinned affected Composer versionsGHSA-5wxr-w449-57cm published
May 14, 2026 by shivammathurModerate