Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

squizlabs/php_codesniffer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3PackagistAmendedPublished

    PHP_CodeSniffer gitblame report command injection via crafted filename

    CVE-2026-67434 · GHSA-hmqg-cxww-wqhq

    Affected
    • Packagist squizlabs/php_codesniffer < 3.13.6; >= 4.0.0, < 4.0.2
    Fixed in
    4.0.23.13.6· Vendor fix available
    Issue
    Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame report(s). As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. Users using the default Full report, or any of the other non-blame reports, are not affected. Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected. Patched versions The issue has been fixed in PHPCodeSniffer v3.13.6 and v4.0.2. We recommend all users upgrade to these versions at their earliest convenience. Workaround Users of PHPCodeSniffer who cannot upgrade immediately should ensure they do not use the…

    Recommended action: Upgrade to 4.0.2 or 3.13.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. UnratedPackagistPublished

    Arbitrary shell execution

    GHSA-3988-h75v-hwf6

    Affected
    • Packagist squizlabs/php_codesniffer >= 3.0.0, < 3.0.1
    Fixed in
    3.0.1· Vendor fix available
    Issue
    A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option

    Recommended action: Upgrade to 3.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  3. UnratedPackagistPublished

    Arbitrary shell execution

    GHSA-mhfv-8rc9-w38c

    Affected
    • Packagist squizlabs/php_codesniffer >= 1.0.0, < 2.8.1
    Fixed in
    2.8.1· Vendor fix available
    Issue
    Uses of shellexec() and exec() were not escaping filenames and configuration settings in most cases

    Recommended action: Upgrade to 2.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →