CVE-2026-67434

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67434
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67434.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67434
Aliases
Published
2026-08-06T21:31:32.511Z
Modified
2026-08-09T03:30:18.601104620Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PHP_CodeSniffer gitblame report command injection via crafted filename
Details

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running PHP_CodeSniffer over untrusted files, for example in a continuous integration pipeline that scans pull requests, or on a developer machine reviewing third party code, could result in attacker controlled shell commands being executed when the Gitblame, Hgblame, or Svnblame report processes a file whose name contains shell metacharacters. Users using the default Full report, or any of the other non-blame reports, are not affected. Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected. This issue is fixed in versions 3.13.6 and 4.0.2.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67434.json"
}
References

Affected packages

Git / github.com/phpcsstandards/php_codesniffer

Affected ranges

Type
GIT
Repo
https://github.com/phpcsstandards/php_codesniffer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
06113cfdaf117fc2165f9cd040bd0f17fcd5242d
Fixed
4c378e1a528ea066890fc2397cbdd2f94eb2fc91
Fixed
74ee2d4df09b70996c1e0fafca7079fc0bbb9ec0
Fixed
7a3a6bbf153a03fa3a9413afc60bded6b764e76b
Fixed
f0e1ebb0563f0e5d7f190497a787bcaf8474f3fe
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.13.6"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.2"
        }
    ]
}

Affected versions

1.*
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.4.0
1.4.1
1.4.2
1.5.0RC1
1.5.0RC2
2.*
2.0.0
2.0.0RC1
2.0.0RC2
2.0.0RC3
2.0.0RC4
2.0.0a1
2.0.0a2
2.1.0
2.2.0
2.3.0
3.*
3.0.0
3.0.0RC1
3.0.0RC2
3.0.0RC3
3.0.0RC4
3.0.0a1
3.0.1
3.0.2
3.1.0
3.1.1
3.10.0
3.10.1
3.10.2
3.10.3
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
3.12.2
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.13.5
3.2.0
3.2.1
3.2.2
3.2.3
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.6.0
3.6.1
3.6.2
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.9.0
3.9.1
3.9.2
4.*
4.0.0
4.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67434.json"