p PatchFirst

PatchFirst · Latest vulnerabilities

squizlabs/php_codesniffer vulnerabilities

Vulnerabilities published for squizlabs/php_codesniffer in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2026-67434

    High · CVSS 7.3EPSS 1.06%Fix available

    PHP_CodeSniffer gitblame report command injection via crafted filename

    PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running PHP_CodeSniffer over untrusted files, for example in a continuous integration pipeline that scans pull requests, or on a developer machine reviewing third party code, could result in attacker controlled shell commands being executed when the Gitblame, Hgblame, or Svnblame report processes a file whose name contains shell metacharacters. Users using the def

    squizlabs/php_codesniffer squizlabs/php_codesnifferPHP
    • Update to 3.13.6
    • Update to 4.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →