highCVE-2026-67434Aug 6, 2026

CVE-2026-67434: PHP_CodeSniffer OS Command Injection via Crafted Filename in Blame Reports

Rohit Hatagale
AI Security Researcher, SecureLayer7

PHP_CodeSniffer passes unsanitized filenames directly to shell commands when generating Gitblame, Hgblame, or Svnblame reports, letting an attacker run arbitrary OS commands by naming a file with…

Packagesquizlabs/php_codesniffer
Ecosystemcomposer
Affected< 3.13.6
Fixed in3.13.6
CVE-2026-67434: PHP_CodeSniffer OS Command Injection via Crafted Filename in Blame Reports

The problem

The Gitblame, Hgblame, and Svnblame report classes construct a shell command (e.g. git blame --porcelain) by interpolating the raw file path string without escaping it first. Any file whose name contains shell metacharacters such as ", ;, or $() breaks out of that command string.

The impact is full OS command execution in the security context of the user running PHPCS. The most dangerous scenario is a CI pipeline that scans pull requests from untrusted forks, since the attacker controls the filenames committed to the repository.

Proof of concept

A working proof-of-concept for CVE-2026-67434 in squizlabs/php_codesniffer, with the exact payload below.

bash
# Create a file whose name injects a command when processed by --report=gitblame
touch $'evil"; id > /tmp/pwned; echo "'

The blame report classes called shell_exec() (or equivalent) with a command string like 'git blame --porcelain "' . $filename . '"', where $filename came from the scanned file path with no sanitization. A filename containing " terminates the double-quoted shell argument, and ; then starts a new command, giving the attacker arbitrary execution.

Commit 7a3a6bbf (PR #1473) fixed all three blame report classes by wrapping every file path with escapeshellarg() before interpolation, so the filename is always treated as a single opaque argument by the shell. This is CWE-78: Improper Neutralization of Special Elements used in an OS Command.

The fix

Upgrade to PHP_CodeSniffer 3.13.6 or 4.0.2. If you cannot upgrade immediately, stop using the --report=gitblame, --report=hgblame, and --report=svnblame options when scanning untrusted code. This applies especially to CI jobs, pre-commit hooks, and any service that processes third-party repositories.

Reported by Faze-up and edorian.

References: [1][2][3][4][5][6]

Related research