{"schema":"threatline.record/2","record":{"id":"CVE-2026-67434","aliases":["GHSA-hmqg-cxww-wqhq"],"summary":"PHP_CodeSniffer gitblame report command injection via crafted filename","details":"### Impact\n\nPHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the `Gitblame`, `Hgblame` and `Svnblame` report(s).\n\nAs a result, running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the `Gitblame`, `Hgblame` or `Svnblame` report(s) would process a file whose name contains shell metacharacters.\n\n* Users using the default `Full` report, or any of the other non-*blame reports, are not affected.\n* Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as `\"` and `;`, are not affected.\n\n### Patched versions\n\nThe issue has been fixed in PHP_CodeSniffer v3.13.6 and v4.0.2. We recommend all users upgrade to these versions at their earliest convenience.\n\n### Workaround\n\nUsers of PHP_CodeSniffer who cannot upgrade immediately should ensure they do not use the `Gitblame`, `Hgblame` or the `Svnblame` reports when scanning untrusted code.\n\nThis is especially relevant for CI jobs, pre-commit or review tooling, automated review services, and any service that scans untrusted repositories or uploaded source trees.\n\n### Credits\n\nMany thanks to both [@Faze-up](https://github.com/Faze-up) and [@edorian](https://github.com/edorian) for responsibly disclosing this vulnerability.\n\n### How can I report a security bug?\n\nPlease report security vulnerabilities privately via [the \"Security and quality\" tab on the PHP_CodeSniffer repository](https://github.com/PHPCSStandards/PHP_CodeSniffer/security).","categories":["Libraries & packages"],"product":"squizlabs/php_codesniffer","vendor":"PHPCSStandards","ecosystem":"composer","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-hmqg-cxww-wqhq","source_modified_at":"2026-10-03T09:47:38Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"squizlabs/php_codesniffer"},"range":"< 3.13.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-hmqg-cxww-wqhq","source_modified_at":"2026-10-03T09:47:38Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"squizlabs/php_codesniffer"},"range":">= 4.0.0, < 4.0.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67434","source_modified_at":"2026-08-07T15:37:19.375Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"PHP_CodeSniffer","vendor":"PHPCSStandards","versions":[{"version":"< 3.13.6","status":"affected"},{"version":">= 4.0.0, < 4.0.2","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-hmqg-cxww-wqhq","source_modified_at":"2026-08-06T21:56:03.572757Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"squizlabs/php_codesniffer","ecosystem":"Packagist","purl":"pkg:composer/squizlabs/php_codesniffer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.6"}]}],"versions":["1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.5.0","1.5.0RC1","1.5.0RC2","1.5.0RC3","1.5.0RC4","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","2.0.0","2.0.0RC1","2.0.0RC2","2.0.0RC3","2.0.0RC4","2.0.0a1","2.0.0a2","2.1.0","2.2.0","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2","3.0.0","3.0.0RC1","3.0.0RC2","3.0.0RC3","3.0.0RC4"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-hmqg-cxww-wqhq","source_modified_at":"2026-08-06T21:56:03.572757Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"squizlabs/php_codesniffer","ecosystem":"Packagist","purl":"pkg:composer/squizlabs/php_codesniffer"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}]}],"versions":["4.0.0","4.0.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-hmqg-cxww-wqhq","source_modified_at":"2026-10-03T09:47:38Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"squizlabs/php_codesniffer"},"version":"3.13.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-hmqg-cxww-wqhq","source_modified_at":"2026-10-03T09:47:38Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"composer","name":"squizlabs/php_codesniffer"},"version":"4.0.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-hmqg-cxww-wqhq","source_modified_at":"2026-08-06T21:56:03.572757Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"squizlabs/php_codesniffer","ecosystem":"Packagist","purl":"pkg:composer/squizlabs/php_codesniffer"},"version":"3.13.6"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-hmqg-cxww-wqhq","source_modified_at":"2026-08-06T21:56:03.572757Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"squizlabs/php_codesniffer","ecosystem":"Packagist","purl":"pkg:composer/squizlabs/php_codesniffer"},"version":"4.0.2"}],"cvss":7.3,"severity":"High","kev":{"listed":false},"epss":{"probability":0.01063,"percentile":0.64376,"score_date":"2026-10-23"},"published_at":"2026-08-06T21:31:32.511Z","modified_at":"2026-10-03T09:47:38Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-hmqg-cxww-wqhq","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-03T09:47:38Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-67434","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-08-07T15:37:19.375Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-hmqg-cxww-wqhq","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-08-06T21:56:03.572757Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-67434","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/7a3a6bbf153a03fa3a9413afc60bded6b764e76b","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/f0e1ebb0563f0e5d7f190497a787bcaf8474f3fe","tags":["x_refsource_MISC"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/squizlabs/php_codesniffer/CVE-2026-67434.yaml","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/3.13.6","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/4.0.2","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-hmqg-cxww-wqhq","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-08-07T15:36:31.165042Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-03T09:47:38Z","content_hash":"35d11fbfaf9ecda749f08fc4dd7353f1a48f5edfe0b2c455a898f37127987078"}}