CVE-2026-67434: PHP_CodeSniffer gitblame report command injection via crafted filename
(updated )
PHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame report(s).
As a result, running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters.
- Users using the default
Fullreport, or any of the other non-*blame reports, are not affected. - Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as
"and;, are not affected.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/squizlabs/php_codesniffer/CVE-2026-67434.yaml
- github.com/PHPCSStandards/PHP_CodeSniffer/commit/7a3a6bbf153a03fa3a9413afc60bded6b764e76b
- github.com/PHPCSStandards/PHP_CodeSniffer/commit/f0e1ebb0563f0e5d7f190497a787bcaf8474f3fe
- github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473
- github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/3.13.6
- github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/4.0.2
- github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq
- github.com/advisories/GHSA-hmqg-cxww-wqhq
- nvd.nist.gov/vuln/detail/CVE-2026-67434
Code Behaviors & Features
Detect and mitigate CVE-2026-67434 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →