PHPCSUtils, which supplies utility functions for PHP_CodeSniffer, contains a flaw in the function that extracts array keys during static code analysis. The flaw uses eval() on array‑key expressions that originate from user‑supplied PHP code. An attacker who supplies PHP code to be scanned can supply arbitrary expressions that evaluate to executable code, allowing the attacker to run arbitrary commands on the host performing the scan. This is a classic remote code execution vulnerability, classified under CWE‑95.

Vulnerable versions of PHPCSUtils from 1.0.0‑alpha1 through 1.2.3 are affected. Users who run these releases during PHP_CodeSniffer scans are at risk. The issue is fixed in PHPCSUtils 1.2.3.

The vulnerability has a CVSS score of 8.6, indicating high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an attacker to supply or influence PHP code that will be scanned; this is typically a local or privileged code‑execution scenario where the scanning host processes untrusted code. Exploitation is straightforward for users that import or scan external PHP files without validating their contents.