All vulnerabilities
CVE-2026-67434GHSA-hmqg-cxww-wqhq

squizlabs/php_codesniffer: PHP_CodeSniffer gitblame report command injection via crafted filename

PHPCSStandards squizlabs/php_codesniffercomposerLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.06%Chance of exploitation activity in the next 30 days, higher than 64% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.13.6Also 4.0.2GitHub
Published6 Aug 2026Updated 3 Oct 2026CVE List

What fixes it

  • 3.13.6squizlabs/php_codesniffer, composerGitHubcomposer require "squizlabs/php_codesniffer:^3.13.6"
  • 4.0.2squizlabs/php_codesniffer, composerGitHubcomposer require "squizlabs/php_codesniffer:^4.0.2"
  • 3.13.6squizlabs/php_codesniffer, PackagistOSVcomposer require "squizlabs/php_codesniffer:^3.13.6"
  • 4.0.2squizlabs/php_codesniffer, PackagistOSVcomposer require "squizlabs/php_codesniffer:^4.0.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

PHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame report(s).

As a result, running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters.

  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected.

Patched versions

The issue has been fixed in PHP_CodeSniffer v3.13.6 and v4.0.2. We recommend all users upgrade to these versions at their earliest convenience.

Workaround

Users of PHP_CodeSniffer who cannot upgrade immediately should ensure they do not use the Gitblame, Hgblame or the Svnblame reports when scanning untrusted code.

This is especially relevant for CI jobs, pre-commit or review tooling, automated review services, and any service that scans untrusted repositories or uploaded source trees.

Credits

Many thanks to both @Faze-up and @edorian for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHP_CodeSniffer repository.

Text from GitHub Advisory Database

Affected versions 58

  • squizlabs/php_codesniffer, composer< 3.13.6GitHub
  • squizlabs/php_codesniffer, composer>= 4.0.0, < 4.0.2GitHub
  • PHP_CodeSnifferaffected: < 3.13.6CVE List
  • PHP_CodeSnifferaffected: >= 4.0.0, < 4.0.2CVE List
  • squizlabs/php_codesniffer, Packagistfrom first release, fixed in 3.13.6OSV
  • squizlabs/php_codesniffer, Packagist1.4.2OSV
  • squizlabs/php_codesniffer, Packagist1.4.3OSV
  • squizlabs/php_codesniffer, Packagist1.4.4OSV
  • squizlabs/php_codesniffer, Packagist1.4.5OSV
  • squizlabs/php_codesniffer, Packagist1.4.6OSV
  • squizlabs/php_codesniffer, Packagist1.4.7OSV
  • squizlabs/php_codesniffer, Packagist1.4.8OSV
  • squizlabs/php_codesniffer, Packagist1.5.0OSV
  • squizlabs/php_codesniffer, Packagist1.5.0RC1OSV
  • squizlabs/php_codesniffer, Packagist1.5.0RC2OSV
  • squizlabs/php_codesniffer, Packagist1.5.0RC3OSV
  • squizlabs/php_codesniffer, Packagist1.5.0RC4OSV
  • squizlabs/php_codesniffer, Packagist1.5.1OSV
  • squizlabs/php_codesniffer, Packagist1.5.2OSV
  • squizlabs/php_codesniffer, Packagist1.5.3OSV
  • squizlabs/php_codesniffer, Packagist1.5.4OSV
  • squizlabs/php_codesniffer, Packagist1.5.5OSV
  • squizlabs/php_codesniffer, Packagist1.5.6OSV
  • squizlabs/php_codesniffer, Packagist2.0.0OSV
  • squizlabs/php_codesniffer, Packagist2.0.0RC1OSV
  • squizlabs/php_codesniffer, Packagist2.0.0RC2OSV
  • squizlabs/php_codesniffer, Packagist2.0.0RC3OSV
  • squizlabs/php_codesniffer, Packagist2.0.0RC4OSV
  • squizlabs/php_codesniffer, Packagist2.0.0a1OSV
  • squizlabs/php_codesniffer, Packagist2.0.0a2OSV
  • squizlabs/php_codesniffer, Packagist2.1.0OSV
  • squizlabs/php_codesniffer, Packagist2.2.0OSV
  • squizlabs/php_codesniffer, Packagist2.3.0OSV
  • squizlabs/php_codesniffer, Packagist2.3.1OSV
  • squizlabs/php_codesniffer, Packagist2.3.2OSV
  • squizlabs/php_codesniffer, Packagist2.3.3OSV
  • squizlabs/php_codesniffer, Packagist2.3.4OSV
  • squizlabs/php_codesniffer, Packagist2.4.0OSV
  • squizlabs/php_codesniffer, Packagist2.5.0OSV
  • squizlabs/php_codesniffer, Packagist2.5.1OSV
  • squizlabs/php_codesniffer, Packagist2.6.0OSV
  • squizlabs/php_codesniffer, Packagist2.6.1OSV
  • squizlabs/php_codesniffer, Packagist2.6.2OSV
  • squizlabs/php_codesniffer, Packagist2.7.0OSV
  • squizlabs/php_codesniffer, Packagist2.7.1OSV
  • squizlabs/php_codesniffer, Packagist2.8.0OSV
  • squizlabs/php_codesniffer, Packagist2.8.1OSV
  • squizlabs/php_codesniffer, Packagist2.9.0OSV
  • squizlabs/php_codesniffer, Packagist2.9.1OSV
  • squizlabs/php_codesniffer, Packagist2.9.2OSV
  • squizlabs/php_codesniffer, Packagist3.0.0OSV
  • squizlabs/php_codesniffer, Packagist3.0.0RC1OSV
  • squizlabs/php_codesniffer, Packagist3.0.0RC2OSV
  • squizlabs/php_codesniffer, Packagist3.0.0RC3OSV
  • squizlabs/php_codesniffer, Packagist3.0.0RC4OSV
  • squizlabs/php_codesniffer, Packagistfrom 4.0.0, fixed in 4.0.2OSV
  • squizlabs/php_codesniffer, Packagist4.0.0OSV
  • squizlabs/php_codesniffer, Packagist4.0.1OSV

References 8