Threats affecting pkg:github/phpcsstandards/PHP_CodeSniffer

PHP_CodeSniffer versions prior to 3.13.6 and 4.0.2 contain a command injection vulnerability in the code generating Gitblame, Hgblame, and Svnblame report formats. This vulnerability allows attacker-controlled shell commands to be executed if a file name contains shell metacharacters and is processed by these blame report formats. Users running default or other non-blame reports, or on platforms that disallow such filenames, are not affected. The issue is fixed in versions 3.13.6 and 4.0.2.