CVE-2026-67434
1 advisory.
Packagist/squizlabs/php_codesniffer CVE-2026-67434: high, EPSS 1.06%
PHP_CodeSniffer gitblame report command injection via crafted filename
Action: Upgrade squizlabs/php_codesniffer to 3.13.6 or later.
composer require squizlabs/php_codesniffer:3.13.6composer require squizlabs/php_codesniffer:4.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.13.6 | - |
| 4.0.0 | 4.0.2 | - |
Fixed versions
| 3.13.6 | 4.0.2 |
Sources
- osv: GHSA-hmqg-cxww-wqhq
- https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq
- https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473
- https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/7a3a6bbf153a03fa3a9413afc60bded6b764e76b
- https://github.com/PHPCSStandards/PHP_CodeSniffer/commit/f0e1ebb0563f0e5d7f190497a787bcaf8474f3fe
- https://github.com/FriendsOfPHP/security-advisories/blob/master/squizlabs/php_codesniffer/CVE-2026-67434.yaml
- https://github.com/PHPCSStandards/PHP_CodeSniffer
- https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/3.13.6
- https://github.com/PHPCSStandards/PHP_CodeSniffer/releases/tag/4.0.2
CVE-2026-67434 · published · modified · JSON