{"matches":[{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=873d0262023e54b1","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/announce-release.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=9e7f043882c243f8","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/auto-release.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=d5997278ef61e6c7","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/bcc.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=44efc4fc656aae59","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/build-docker.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=b12e43ec836e3b0b","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/build-phar.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=912607c921cf887a","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/build-stubs.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=770f44ac110f69d3","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/ci.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=73e3064dbe82718a","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/perf.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=e9750a258b11c657","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/shepherd.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5wxr-w449-57cm","dataSource":"https://github.com/advisories/GHSA-5wxr-w449-57cm","namespace":"github:language:github-action","severity":"Medium","urls":["https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","https://github.com/shivammathur/setup-php/security/advisories/GHSA-5wxr-w449-57cm","https://github.com/shivammathur/setup-php/commit/7748c243803a56671412f9f7c745769e9573c6d4"],"description":"Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.37.1"],"state":"fixed","available":[{"version":"2.37.1","date":"2026-05-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"shivammathur/setup-php","version":"v2"}},"found":{"vulnerabilityID":"GHSA-5wxr-w449-57cm","versionConstraint":"<2.37.1 (unknown)"},"fix":{"suggestedVersion":"2.37.1"}}],"artifact":{"id":"pkg:github/shivammathur/setup-php@v2?package-id=b8fe485817ea6ce7","name":"shivammathur/setup-php","version":"v2","type":"github-action","locations":[{"path":"/.github/workflows/windows-ci.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup-php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup_php:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup-php:v2:*:*:*:*:*:*:*","cpe:2.3:a:shivammathur\\/setup:shivammathur\\/setup_php:v2:*:*:*:*:*:*:*"],"purl":"pkg:github/shivammathur/setup-php@v2","upstreams":[]}}],"source":{"type":"file","target":"vimeo/psalm"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:08:46.095836532Z"}}