CVE-2026-67434: PHP_CodeSniffer command injection in blame reports via crafted filename

Executive brief

PHP_CodeSniffer, a tool used to detect violations of coding standards, is vulnerable to a security flaw when generating specific reports. If an attacker provides a file with a specially crafted name containing shell characters, they can execute arbitrary commands on the system running the scan. This is particularly dangerous for automated environments like CI/CD pipelines that scan untrusted code from pull requests or third-party repositories.

Technical details

A command injection vulnerability exists in PHP_CodeSniffer's Gitblame, Hgblame, and Svnblame report generators. The root cause is the improper neutralization of shell metacharacters (such as semicolons or quotes) within filenames before they are passed to system commands. An attacker can exploit this by submitting a file with a crafted name to a repository being scanned. If the victim runs PHP_CodeSniffer with one of the affected blame reports enabled, the malicious filename will trigger arbitrary command execution with the privileges of the user running the tool. The issue is fixed in versions 3.13.6 and 4.0.2.

Affected products

• PHPCSStandards PHP_CodeSniffer < 3.13.6, >= 4.0.0, < 4.0.2

Timeline

• 2026-08-06: disclosed
• 2026-08-06: patched
• 2026-08-06: advisory

References

• https://api.github.com/users/Faze-up
• https://github.com/Faze-up
• https://api.github.com/users/Faze-up/gists%7B/gist_id%7D
• https://api.github.com/users/Faze-up/repos
• https://avatars.githubusercontent.com/u/45031662?v=4
• https://api.github.com/users/Faze-up/events%7B/privacy%7D