Command Injection Affecting squizlabs/php_codesniffer package, versions <3.13.6>=4.0.0, <4.0.2
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-SQUIZLABSPHPCODESNIFFER-18565129
- published6 Aug 2026
- disclosed6 Aug 2026
- creditt4z1ge, Volker Dusch
Introduced: 6 Aug 2026
NewCVE-2026-67434 (opens in a new tab)How to fix?
Upgrade squizlabs/php_codesniffer to version 3.13.6, 4.0.2 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection via filename handling in the Gitblame, Hgblame, and Svnblame report generators. An attacker can execute arbitrary shell commands by supplying an untrusted file whose name contains shell metacharacters. When PHP_CodeSniffer generates one of the affected blame reports, the filename is incorporated into a shell command without proper neutralization, allowing command execution in the context of the user or CI runner performing the scan.
Note:
This is only exploitable when
PHP_CodeSnifferuntrusted files and generates theGitblame,Hgblame, orSvnblamereports.The default Full report and other non-blame reports are not affected. Platforms that do not permit the relevant shell metacharacters in filenames are also not affected.