p PatchFirst

CVE-2026-67434

CVE-2026-67434 · PHP_CodeSniffer gitblame report command injection via crafted filename

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running PHP_CodeSniffer over untrusted files, for example in a continuous integration pipeline that scans pull requests, or on a developer machine reviewing third party code, could result in attacker controlled shell commands being executed when the Gitblame, Hgblame, or Svnblame report processes a file whose name contains shell metacharacters. Users using the default Full report, or any of the other non-blame reports, are not affected. Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected. This issue is fixed in versions 3.13.6 and 4.0.2.

CVSS 7.3 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • php_codesniffer

    Versions
    • < 3.13.6: Affected
    • >= 4.0.0, < 4.0.2: Affected

    No fix published

  • squizlabs/php_codesniffer Packagist

    Versions
    • 1.4.2
    • 1.4.3
    • 1.4.4
    • 1.4.5
    • 1.4.6
    • 1.4.7
    • 1.4.8
    • 1.5.0
    • 1.5.0RC1
    • 1.5.0RC2
    • 1.5.0RC3
    • 1.5.0RC4
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    • 1.5.5
    • 1.5.6
    • 2.0.0
    • 2.0.0RC1
    • 2.0.0RC2
    • 2.0.0RC3
    • 2.0.0RC4
    • 2.0.0a1
    • 2.0.0a2
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.4.0
    • 2.5.0
    • 2.5.1
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.7.0
    • 2.7.1
    • 2.8.0
    • 2.8.1
    • 2.9.0
    • 2.9.1
    • 2.9.2
    • 3.0.0
    • 3.0.0RC1
    • 3.0.0RC2
    • 3.0.0RC3
    • 3.0.0RC4
    • 3.0.0a1
    • 3.0.1
    • 3.0.2
    • 3.1.0
    • 3.1.1
    • 3.10.0
    • 3.10.1
    • 3.10.2
    • 3.10.3
    • 3.11.0
    • 3.11.1
    • 3.11.2
    • 3.11.3
    • 3.12.0
    • 3.12.1
    • 3.12.2
    • 3.13.0
    • 3.13.1
    • 3.13.2
    • 3.13.3
    • 3.13.4
    • 3.13.5
    • 3.2.0
    • 3.2.1
    • 3.2.2
    • 3.2.3
    • 3.3.0
    • 3.3.1
    • 3.3.2
    • 3.4.0
    • 3.4.1
    • 3.4.2
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.5.3
    • 3.5.4
    • 3.5.5
    • 3.5.6
    • 3.5.7
    • 3.5.8
    • 3.6.0
    • 3.6.1
    • 3.6.2
    • 3.7.0
    • 3.7.1
    • 3.7.2
    • 3.8.0
    • 3.8.1
    • 3.9.0
    • 3.9.1
    • 3.9.2
    Affected ranges
    • ECOSYSTEM: < 3.13.6

    Update to 3.13.6

  • squizlabs/php_codesniffer Packagist

    Versions
    • 4.0.0
    • 4.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.0.2

    Update to 4.0.2

Original sources

Check your server →