{"id":"CVE-2026-67434","title":"PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards","summary":"PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgbl…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"Red Hat","product":"squizlabs/php_codesniffer","affected":["squizlabs/php_codesniffer < 3.13.6","squizlabs/php_codesniffer >= 4.0.0, < 4.0.2"],"patched":["squizlabs/php_codesniffer 3.13.6","squizlabs/php_codesniffer 4.0.2"],"published":"2026-08-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:41:33.140","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67434","references":[{"url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/7a3a6bbf153a03fa3a9413afc60bded6b764e76b","label":"security-advisories@github.com"},{"url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/f0e1ebb0563f0e5d7f190497a787bcaf8474f3fe","label":"security-advisories@github.com"},{"url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473","label":"security-advisories@github.com"},{"url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/3.13.6","label":"security-advisories@github.com"},{"url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/4.0.2","label":"security-advisories@github.com"},{"url":"https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67434.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-67434"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67434"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/squizlabs/php_codesniffer/CVE-2026-67434.yaml"},{"url":"https://github.com/advisories/GHSA-hmqg-cxww-wqhq"}],"tags":["nvd","csaf","vex","red-hat","ghsa","composer"],"epss":0.00701,"epssPercentile":0.51798,"aliases":["GHSA-hmqg-cxww-wqhq"],"ecosystem":"composer","cvssSource":"vendor","ingestedAt":"2026-08-06T22:05:23.183Z","slug":"CVE-2026-67434","body":"## Overview\n\nPHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running PHP_CodeSniffer over untrusted files, for example in a continuous integration pipeline that scans pull requests, or on a developer machine reviewing third party code, could result in attacker controlled shell commands being executed when the Gitblame, Hgblame, or Svnblame report processes a file whose name contains shell metacharacters. Users using the default Full report, or any of the other non-blame reports, are not affected. Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as \" and ;, are not affected. This issue is fixed in versions 3.13.6 and 4.0.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-67434)\n\nAffected packages:\n\n- `squizlabs/php_codesniffer < 3.13.6`\n- `squizlabs/php_codesniffer >= 4.0.0, < 4.0.2`\n\nPatched in:\n\n- `squizlabs/php_codesniffer 3.13.6`\n- `squizlabs/php_codesniffer 4.0.2`\n\nSource: https://github.com/advisories/GHSA-hmqg-cxww-wqhq\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67434.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201868,"id":"CVE-2026-67434","ts":1789399939683,"field":"cvss","old":null,"new":"7.8"},{"seq":200598,"id":"CVE-2026-67434","ts":1789397463474,"field":"cvss","old":"7.8","new":null},{"seq":198515,"id":"CVE-2026-67434","ts":1789392048508,"field":"cvss","old":null,"new":"7.8"},{"seq":196306,"id":"CVE-2026-67434","ts":1789383663979,"field":"cvss","old":"7.8","new":null},{"seq":195235,"id":"CVE-2026-67434","ts":1789380514802,"field":"cvss","old":null,"new":"7.8"},{"seq":194022,"id":"CVE-2026-67434","ts":1789378600523,"field":"cvss","old":"7.8","new":null},{"seq":192809,"id":"CVE-2026-67434","ts":1789376445556,"field":"cvss","old":null,"new":"7.8"},{"seq":191596,"id":"CVE-2026-67434","ts":1789373519848,"field":"cvss","old":"7.8","new":null},{"seq":190381,"id":"CVE-2026-67434","ts":1789369394992,"field":"cvss","old":null,"new":"7.8"},{"seq":189168,"id":"CVE-2026-67434","ts":1789368317763,"field":"cvss","old":"7.8","new":null},{"seq":187951,"id":"CVE-2026-67434","ts":1789365185390,"field":"cvss","old":null,"new":"7.8"},{"seq":186738,"id":"CVE-2026-67434","ts":1789363376528,"field":"cvss","old":"7.8","new":null},{"seq":185524,"id":"CVE-2026-67434","ts":1789361163924,"field":"cvss","old":null,"new":"7.8"},{"seq":184311,"id":"CVE-2026-67434","ts":1789358233140,"field":"cvss","old":"7.8","new":null},{"seq":182562,"id":"CVE-2026-67434","ts":1789354260089,"field":"cvss","old":null,"new":"7.8"},{"seq":181355,"id":"CVE-2026-67434","ts":1789353218191,"field":"cvss","old":"7.8","new":null},{"seq":180148,"id":"CVE-2026-67434","ts":1789350212451,"field":"cvss","old":null,"new":"7.8"},{"seq":178941,"id":"CVE-2026-67434","ts":1789348178710,"field":"cvss","old":"7.8","new":null},{"seq":177734,"id":"CVE-2026-67434","ts":1789346319419,"field":"cvss","old":null,"new":"7.8"},{"seq":176527,"id":"CVE-2026-67434","ts":1789343094544,"field":"cvss","old":"7.8","new":null},{"seq":174644,"id":"CVE-2026-67434","ts":1789334826063,"field":"cvss","old":null,"new":"7.8"},{"seq":173439,"id":"CVE-2026-67434","ts":1789333571614,"field":"cvss","old":"7.8","new":null},{"seq":172253,"id":"CVE-2026-67434","ts":1789331044032,"field":"cvss","old":null,"new":"7.8"},{"seq":171067,"id":"CVE-2026-67434","ts":1789328670199,"field":"cvss","old":"7.8","new":null},{"seq":169862,"id":"CVE-2026-67434","ts":1789327097493,"field":"cvss","old":null,"new":"7.8"},{"seq":168657,"id":"CVE-2026-67434","ts":1789323737771,"field":"cvss","old":"7.8","new":null},{"seq":167452,"id":"CVE-2026-67434","ts":1789319621236,"field":"cvss","old":null,"new":"7.8"},{"seq":166247,"id":"CVE-2026-67434","ts":1789318631955,"field":"cvss","old":"7.8","new":null},{"seq":165042,"id":"CVE-2026-67434","ts":1789315740791,"field":"cvss","old":null,"new":"7.8"},{"seq":163837,"id":"CVE-2026-67434","ts":1789313534160,"field":"cvss","old":"7.8","new":null},{"seq":162632,"id":"CVE-2026-67434","ts":1789311848479,"field":"cvss","old":null,"new":"7.8"},{"seq":161427,"id":"CVE-2026-67434","ts":1789308605435,"field":"cvss","old":"7.8","new":null},{"seq":160932,"id":"CVE-2026-67434","ts":1789304549249,"field":"cvss","old":null,"new":"7.8"},{"seq":160479,"id":"CVE-2026-67434","ts":1789304059120,"field":"cvss","old":"7.8","new":null},{"seq":159540,"id":"CVE-2026-67434","ts":1789300430934,"field":"cvss","old":null,"new":"7.8"},{"seq":156529,"id":"CVE-2026-67434","ts":1789294668020,"field":"cvss","old":"7.8","new":null},{"seq":155324,"id":"CVE-2026-67434","ts":1789292850830,"field":"cvss","old":null,"new":"7.8"},{"seq":154119,"id":"CVE-2026-67434","ts":1789289696917,"field":"cvss","old":"7.8","new":null},{"seq":152769,"id":"CVE-2026-67434","ts":1789281587492,"field":"cvss","old":null,"new":"7.8"},{"seq":152409,"id":"CVE-2026-67434","ts":1789281170115,"field":"cvss","old":"7.8","new":null},{"seq":151370,"id":"CVE-2026-67434","ts":1789277574883,"field":"cvss","old":null,"new":"7.8"},{"seq":150331,"id":"CVE-2026-67434","ts":1789276163552,"field":"cvss","old":"7.8","new":null},{"seq":149298,"id":"CVE-2026-67434","ts":1789273780121,"field":"cvss","old":null,"new":"7.8"},{"seq":148265,"id":"CVE-2026-67434","ts":1789271235111,"field":"cvss","old":"7.8","new":null},{"seq":146298,"id":"CVE-2026-67434","ts":1789269314072,"field":"cvss","old":null,"new":"7.8"},{"seq":145102,"id":"CVE-2026-67434","ts":1789266271331,"field":"cvss","old":"7.8","new":null},{"seq":144006,"id":"CVE-2026-67434","ts":1789262551621,"field":"cvss","old":null,"new":"7.8"},{"seq":142910,"id":"CVE-2026-67434","ts":1789261423113,"field":"cvss","old":"7.8","new":null},{"seq":141741,"id":"CVE-2026-67434","ts":1789258778143,"field":"cvss","old":null,"new":"7.8"},{"seq":140582,"id":"CVE-2026-67434","ts":1789256634958,"field":"cvss","old":"7.8","new":null}]}