Threat database

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain a remote code execution vulnerability due to improper neutralization of directives in dynamically evaluated code. The vulnerability exists in the AbstractArrayDeclarationSniff::getActualArrayKey() method, which uses eval() on array keys, allowing execution of arbitrary PHP code. This affects any sniff extending AbstractArrayDeclarationSniff, including some in PHPCSExtra. The issue is fixed in version 1.2.3. Users who cannot upgrade immediately can mitigate risk by disabling the vulnerable sniffs via custom ruleset exclusions.

PHP_CodeSniffer versions prior to 3.13.6 and 4.0.2 contain a command injection vulnerability in the code generating Gitblame, Hgblame, and Svnblame report formats. This vulnerability allows attacker-controlled shell commands to be executed if a file name contains shell metacharacters and is processed by these blame report formats. Users running default or other non-blame reports, or on platforms that disallow such filenames, are not affected. The issue is fixed in versions 3.13.6 and 4.0.2.