Command Injection in PHP_CodeSniffer Affects Code Analysis Security
CVE-2026-67434
7.3HIGH
What is CVE-2026-67434?
PHP_CodeSniffer, a tool for detecting coding standard violations in PHP files, has a command injection vulnerability that can be exploited when processing untrusted files. Attackers can leverage files with shell metacharacters to execute arbitrary shell commands during the generation of Gitblame, Hgblame, and Svnblame report formats. This risk is especially pertinent in environments like continuous integration pipelines or developer machines. Versions 3.13.6 and 4.0.2 of PHP_CodeSniffer provide patching solutions to mitigate these risks.
Affected Version(s)
PHP_CodeSniffer < 3.13.6 < 3.13.6
PHP_CodeSniffer >= 4.0.0, < 4.0.2 < 4.0.0, 4.0.2