CVE-2026-67434

Received Received - Intake

Command Injection in PHP_CodeSniffer

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running PHP_CodeSniffer over untrusted files, for example in a continuous integration pipeline that scans pull requests, or on a developer machine reviewing third party code, could result in attacker controlled shell commands being executed when the Gitblame, Hgblame, or Svnblame report processes a file whose name contains shell metacharacters. Users using the default Full report, or any of the other non-blame reports, are not affected. Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected. This issue is fixed in versions 3.13.6 and 4.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-67434

Affected Vendors & Products

Vendor	Product	Version / Range
php_codesniffer	php_codesniffer	to 4.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

PHP_CodeSniffer is a tool that checks PHP code for compliance with coding standards. This vulnerability allows command injection when generating Gitblame, Hgblame, or Svnblame reports on files with shell metacharacters in their names. Attackers could execute shell commands if untrusted files are processed.

Detection Guidance

To detect this vulnerability, check the installed version of PHP_CodeSniffer. Run: php -r "include 'PHP/CodeSniffer.php'; echo PHP_CodeSniffer::VERSION;". If the version is below 3.13.6 or 4.0.2, the system is vulnerable.

Impact Analysis

If you run PHP_CodeSniffer on untrusted files, such as in CI pipelines or when reviewing third-party code, an attacker could execute malicious shell commands on your system. This could lead to unauthorized access, data theft, or system compromise.

Mitigation Strategies

Upgrade PHP_CodeSniffer to version 3.13.6 or 4.0.2 or later. Avoid running PHP_CodeSniffer on untrusted files, especially in CI pipelines. Disable blame report formats (Gitblame, Hgblame, Svnblame) if not needed.

Hi! I’m here to help you understand CVE-2026-67434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70