Is CVE-2026-67434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67434 being exploited in the wild.

How severe is CVE-2026-67434?

High severity, with a CVSS score of 4, published 6 August 2026.

Which products and versions are affected?

squizlabs/php_codesniffer (Packagist) ECOSYSTEM:introduced=0,fixed=3.13.6; PHPCSStandards PHP CodeSniffer = 4.0.0, < 4.0.2.

Is there a fix for CVE-2026-67434?

Yes. squizlabs/php_codesniffer (Packagist): upgrade to 3.13.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67434 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-67434?

Check whether you run squizlabs/php_codesniffer (Packagist) or PHPCSStandards PHP CodeSniffer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67434: PHP_CodeSniffer command injection in blame reports via crafted filename

Q: Is there a fix for CVE-2026-67434?

Yes. squizlabs/php_codesniffer (Packagist): upgrade to 3.13.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-67434 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-67434?

Check whether you run squizlabs/php_codesniffer (Packagist) or PHPCSStandards PHP CodeSniffer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67434 · Severity: high · CVSS 4 · Published 2026-08-06

PHP_CodeSniffer, a tool used to detect violations of coding standards, is vulnerable to a security flaw when generating specific reports. If an attacker provides a file with a specially crafted name containing shell characters, they can execute arbitrary commands on the system running the scan. This is particularly dangerous for automated environments like CI/CD pipelines that scan untrusted code from pull requests or third-party repositories.

Technologies: squizlabs/php_codesniffer (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-67434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67434 being exploited in the wild.
How severe is CVE-2026-67434?: High severity, with a CVSS score of 4, published 6 August 2026.
Which products and versions are affected?: squizlabs/php_codesniffer (Packagist) ECOSYSTEM:introduced=0,fixed=3.13.6; PHPCSStandards PHP CodeSniffer < 3.13.6, >= 4.0.0, < 4.0.2.
Is there a fix for CVE-2026-67434?: Yes. squizlabs/php_codesniffer (Packagist): upgrade to 3.13.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67434 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-67434?: Check whether you run squizlabs/php_codesniffer (Packagist) or PHPCSStandards PHP CodeSniffer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

squizlabs/php_codesniffer (Packagist): upgrade to 3.13.6 or later
```
composer require squizlabs/php_codesniffer:^3.13.6
```

Technical details

A command injection vulnerability exists in PHP_CodeSniffer's Gitblame, Hgblame, and Svnblame report generators. The root cause is the improper neutralization of shell metacharacters (such as semicolons or quotes) within filenames before they are passed to system commands. An attacker can exploit this by submitting a file with a crafted name to a repository being scanned. If the victim runs PHP_CodeSniffer with one of the affected blame reports enabled, the malicious filename will trigger arbitrary command execution with the privileges of the user running the tool. The issue is fixed in versions 3.13.6 and 4.0.2.

Affected products

PHPCSStandards PHP_CodeSniffer < 3.13.6, >= 4.0.0, < 4.0.2

Identifiers

CVE-2026-67434
GHSA-hmqg-cxww-wqhq

Timeline

2026-08-06: disclosed
2026-08-06: patched
2026-08-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.