CVE-2026-67434 PHP_CodeSniffer gitblame report command injection via crafted filename
Attackers can execute arbitrary shell commands via crafted filenames when using specific blame report formats in PHP_CodeSniffer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-67434?
CVE-2026-67434 is a high-severity command injection vulnerability in PHPCSStandards PHP_CodeSniffer, published on 6 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running PHP_CodeSniffer over untrusted files, for example in a continuous integration pipeline that scans pull requests, or on a developer machine reviewing third party code, could result in attacker controlled shell commands being executed when the Gitblame, Hgblame, or Svnblame report processes a file whose name contains shell metacharacters. Users using the default Full report, or any of the other non-blame reports, are not affected. Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected. This issue is fixed in versions 3.13.6 and 4.0.2.
Weakness: CWE-78
Which versions are affected by CVE-2026-67434?
4 open source packages ship an affected version, including squizlabs/php_codesniffer.
| Package | Affected | Fixed in |
|---|---|---|
squizlabs/php_codesniffer Packagist | All versions | 3.13.6 |
squizlabs/php_codesniffer Packagist | All versions | 3.13.6 |
squizlabs/php_codesniffer Packagist | From 4.0.0 | 4.0.2 |
squizlabs/php_codesniffer Packagist | From 4.0.0 | 4.0.2 |
How do I fix CVE-2026-67434?
Upgrade squizlabs/php_codesniffer to a fixed version for your release line: 3.13.6 or 4.0.2.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-67434 being exploited?
There is no known exploitation of CVE-2026-67434 in the wild and no public exploit code.
Sources
Also known as GHSA-hmqg-cxww-wqhq, MINI-3mh5-p945-wp98, MINI-7289-cjm8-fvfr, MINI-h4g7-8gqp-x5mr.