In PHPUnit versions 12.5.21 and 13.1.5 the framework forwards PHP INI settings to child processes as raw command‑line arguments without neutralizing metacharacters, a flaw exemplified by CWE‑88 and CWE‑93. Because PHP treats a newline as a separator between INI directives, an attacker who can influence a single INI value can inject arbitrary directives such as auto_prepend_file, extension, and disable_functions. By setting auto_prepend_file to a path under the attacker's control, the attacker can execute code in the isolated test process, resulting in remote code execution.

The affected products are PHPUnit supplied by sebastianbergmann. The specific vulnerable releases are 12.5.21 and 13.1.5. All installations running these exact versions are susceptible.

The vulnerability carries a CVSS score of 7.8, indicating high severity, and is not present in the CISA KEV list. No EPSS value is available, but the risk of exploitation remains significant because the attack requires the ability to supply a malicious INI value that is then forwarded to a child process. The potential for remote code execution is direct and can be achieved if an attacker can influence any PHP INI setting used by PHPUnit tests.