GCVE-110-COMPOSER-2026-042289

Advisory Published

Vulnetix · Advisory published October 4, 2026

[PHP-SHELL-EXEC-VAR] PHP OS command execution sink invoked on a variable — matched: $process = proc_open($command, [0 => STDIN, 1 => ['pipe', 'w'], 2 => ['redirect', 1]], $pipes, $cwd, $this->environment($env));

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Affected Products

Vendor	Product	Versions	Platforms
packagist	twstec/kit	2.0.0-beta.7 (affected), 2.0.0-beta.9 (affected), 2.0.0-beta.8 (affected), 2.0.0-beta.10 (affected), 2.0.0-beta.11 (affected), 2.0.0-beta.12 (affected), 2.0.0-beta.13 (affected), 2.0.0-beta.14 (affected), 2.0.0-beta.15 (affected)	—

References

advisory

web

Browse GCVE Records

3,055 records in the GCVE database · Updated October 5, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON