CVE-2026-67434: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in PHPCSStandards PHP_CodeSniffer
PHP_CodeSniffer versions prior to 3.13.6 and 4.0.2 contain a command injection vulnerability in the code generating Gitblame, Hgblame, and Svnblame report formats. This vulnerability allows attacker-controlled shell commands to be executed if a file name with shell metacharacters is processed. Users running default or non-blame reports, or on platforms that disallow such filenames, are not affected. The issue is fixed in versions 3.13.6 and 4.0.2.
AI Analysis
Technical Summary
PHP_CodeSniffer is vulnerable to OS command injection in its blame report generation code (Gitblame, Hgblame, Svnblame) prior to versions 3.13.6 and 4.0.2. The vulnerability arises when processing file names containing shell metacharacters, which can lead to execution of attacker-controlled shell commands. This affects scenarios such as scanning untrusted files in CI pipelines or reviewing third-party code. Non-blame reports and platforms restricting shell metacharacters in filenames are not impacted. The vulnerability is addressed in versions 3.13.6 and 4.0.2.
Potential Impact
An attacker who can influence file names processed by PHP_CodeSniffer's blame report generation can execute arbitrary shell commands with the privileges of the user running PHP_CodeSniffer. This could lead to code execution on developer machines or CI environments scanning untrusted code. The vulnerability does not affect default or other non-blame reports, nor platforms that restrict shell metacharacters in filenames.
Mitigation Recommendations
Upgrade PHP_CodeSniffer to version 3.13.6 or later, or 4.0.2 or later, where this vulnerability is fixed. Users relying on default or non-blame reports, or on platforms that disallow shell metacharacters in filenames, are not affected and may not require immediate action. Patch status is not explicitly stated in the vendor advisory, but the fix is included in the specified versions.
CVE-2026-67434: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in PHPCSStandards PHP_CodeSniffer
Description
PHP_CodeSniffer versions prior to 3.13.6 and 4.0.2 contain a command injection vulnerability in the code generating Gitblame, Hgblame, and Svnblame report formats. This vulnerability allows attacker-controlled shell commands to be executed if a file name with shell metacharacters is processed. Users running default or non-blame reports, or on platforms that disallow such filenames, are not affected. The issue is fixed in versions 3.13.6 and 4.0.2.
CVSS v4.0
Score 7.3high
Affected software
pkg:github/phpcsstandards/PHP_CodeSnifferRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PHP_CodeSniffer is vulnerable to OS command injection in its blame report generation code (Gitblame, Hgblame, Svnblame) prior to versions 3.13.6 and 4.0.2. The vulnerability arises when processing file names containing shell metacharacters, which can lead to execution of attacker-controlled shell commands. This affects scenarios such as scanning untrusted files in CI pipelines or reviewing third-party code. Non-blame reports and platforms restricting shell metacharacters in filenames are not impacted. The vulnerability is addressed in versions 3.13.6 and 4.0.2.
Potential Impact
An attacker who can influence file names processed by PHP_CodeSniffer's blame report generation can execute arbitrary shell commands with the privileges of the user running PHP_CodeSniffer. This could lead to code execution on developer machines or CI environments scanning untrusted code. The vulnerability does not affect default or other non-blame reports, nor platforms that restrict shell metacharacters in filenames.
Mitigation Recommendations
Upgrade PHP_CodeSniffer to version 3.13.6 or later, or 4.0.2 or later, where this vulnerability is fixed. Users relying on default or non-blame reports, or on platforms that disallow shell metacharacters in filenames, are not affected and may not require immediate action. Patch status is not explicitly stated in the vendor advisory, but the fix is included in the specified versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-29T15:07:24.991Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a75070abf8831d5395f5c06
Added to database: 08/06/2026, 22:13:30 UTC
Last enriched: 08/06/2026, 22:43:35 UTC
Last updated: 08/06/2026, 23:12:29 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.