Vendor Phpunit Phpunit Src Util Php Eval-stdin.php Cve |work|

The vulnerability you are referring to is CVE-2017-9841, a critical unauthenticated Remote Code Execution (RCE) flaw in PHPUnit. It stems from the file Util/PHP/eval-stdin.php incorrectly processing raw HTTP POST data as PHP code. The Vulnerability

This vulnerability exists in the eval-stdin.php file, which is part of the PHPUnit testing framework. The script was designed to process input for unit tests but was inadvertently left with a major security flaw: it uses eval() on raw data from the php://input wrapper. vendor phpunit phpunit src util php eval-stdin.php cve

• Never include dev dependencies in production artifacts.
• Use artifact-building where only required runtime files are packaged.

rm vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php