WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
WordPress Coding Standards (WordPressCS) versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the …