DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-67434: CVE-2026-67434: OS Command Injection via Malicious Filenames in PHP_CodeSniffer Blame Reports

#security #cve #cybersecurity

CVE-2026-67434: OS Command Injection via Malicious Filenames in PHP_CodeSniffer Blame Reports

Vulnerability ID: CVE-2026-67434
CVSS Score: 7.3
Published: 2026-08-06

A critical OS command injection vulnerability exists in PHP_CodeSniffer's VCS blame report modules (Gitblame, Hgblame, Svnblame). Due to inadequate escaping of filenames passed to shell execution wrappers like popen(), an attacker who commits a file with a maliciously crafted name can execute arbitrary commands when the victim generates a blame report.

TL;DR

Unauthenticated OS command injection in PHP_CodeSniffer VCS reports due to unescaped filename concatenation in popen() calls.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-78
  • Attack Vector: Local
  • CVSS Score: 7.3
  • EPSS Score: Not established
  • Impact: Arbitrary Code Execution
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • PHP_CodeSniffer
  • PHP_CodeSniffer: < 3.13.6 (Fixed in: 3.13.6)
  • PHP_CodeSniffer: >= 4.0.0, < 4.0.2 (Fixed in: 4.0.2)

Code Analysis

Commit: 7a3a6bb

Escape filenames in VCS reports to prevent shell injection (3.x branch)

Commit: f0e1ebb

Escape filenames in VCS reports to prevent shell injection (4.x branch)

Exploit Details

  • Official Test Suite: Verification tests ensuring filenames with shell-sensitive elements are not parsed by the terminal shell.

Mitigation Strategies

  • Upgrade to PHP_CodeSniffer 3.13.6 or 4.0.2 to safely escape arguments.
  • Avoid executing PHP_CodeSniffer with blame reports enabled (--report=Gitblame, --report=Hgblame, --report=Svnblame) on untrusted repositories.
  • Implement pre-commit or pre-scan sanitization checks in CI pipelines to validate filenames against command metacharacters.

Remediation Steps:

  1. Run 'composer update squizlabs/php_codesniffer' in your dependency manifest.
  2. Ensure version constraint resolutions point to 3.13.6+ or 4.0.2+.
  3. Audit CI build definitions and remove VCS blame reporting flags until software is patched.
  4. Configure pipeline scanners to block filenames containing characters like '$', '`', ';', and '|'.

References

Read the full report for CVE-2026-67434 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)