Advisories for Composer/Squizlabs/Php_codesniffer package

PHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame report(s). As a result, running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell …

A properly crafted filename would allow for arbitrary code execution when using the –filter=gitmodified command line option.

Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases.

Arbitrary shell execution in php_codesniffer.

A properly crafted filename would allow for arbitrary code execution when using the –filter=gitmodified command line option

This release contains a fix for a security advisory related to the improper handling of shell commands. Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases A properly crafted filename or configuration option would allow for arbitrary code execution when using some features.

Arbitrary shell execution in php_codesniffer.