packagist package report

Is phpunit_project/phpunit safe?

1 known vulnerability, worst severity CRITICAL.

cvss
9.8

how bad it is if exploited, out of 10

epss
100.0%

chance of exploitation in the next 30 days

xyz score
7.7

CyberXYZ composite, out of 10

fig. 01 — CVE-2017-9841, the advisory selected below

// advisories

CVE-2017-9841

CRITICAL

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Affected
[object Object], [object Object], [object Object]
Fixed in
not stated
Weakness
CWE-94
Published
2017-06-27
Source
NVD

NVDMITREreferencereferencereferencereferencereferencereferencereferencereference

// dependencies

0 direct

Sign in for dependency paths and remediation

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so packagist packages are not covered.

Checked 2026-09-22 at 01:31 UTC. The most recent advisory here was published 2017-06-27. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is phpunit_project/phpunit safe? packagist package security report | CyberXYZ