Detections
Analytics

SCA: security update for phpunit/phpunit (GHSA-vvj3-c3rp-c85p)

high Tenable Self-Hosted Container Security Plugin ID 437240

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8,
 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test
 execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage
 files without validation, potentially allowing remote code execution if malicious `.coverage` files are
 present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which
 should not exist before test execution, is deserialized without the `allowed_classes` parameter
 restriction. An attacker with local file write access can place a malicious serialized object with a
 `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code
 coverage instrumentation enabled. This vulnerability requires local file write access to the location
 where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline
 attacks, the local development environment, and/or compromised dependencies. Rather than just silently
 sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous
 state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting
 in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT
 test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state.
 Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration,
 including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access
 control. (CVE-2026-24765)

Solution

Update the phpunit/phpunit library and its related packages to version 10.5.62 or later.

See Also

https://github.com/advisories/GHSA-vvj3-c3rp-c85p

Plugin Details

Severity: High

ID: 437240

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 1/28/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.96

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-24765

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/27/2026

Vulnerability Publication Date: 1/27/2026

Reference Information

CVE: CVE-2026-24765

cwe: CWE-502