An argument injection vulnerability in PHPUnit versions 12.5.21 and 13.1.6 allows low-privileged local attackers to achieve remote code execution via improperly sanitized INI settings.

This flaw involves improper neutralization of CRLF sequences and argument delimiters, where an attacker with low privileges can manipulate INI values passed to child processes with no user interaction required.

This vulnerability presents a severe risk to development and testing environments by potentially granting full system access to an unauthorized local actor. A successful exploit leads to total compromise of confidentiality, integrity, and availability within the affected child process context. The assigned CVSS score of 7.8 indicates a high severity level, driven primarily by the high technical impact despite requiring local access.

Immediate Action: Update PHPUnit immediately to version 12.5.22 or 13.1.6, or upgrade via Packagist to the fixed releases.

Proactive Monitoring: Monitor build and test environments for anomalous child process execution, unexpected file modifications, and unauthorized configuration changes.

Compensating Controls: Restrict local access to testing environments and enforce strict principle of least privilege principles for accounts permitted to execute test suites.

Public Exploit Available: No - unknown

Security teams must treat this high-severity argument injection flaw with urgency, especially in shared development infrastructures where multiple users can influence test parameters. Applying the provided vendor updates to PHPUnit is the only complete method to neutralize the underlying parsing flaw and prevent remote code execution.