{"uuid": "e40705c2-14ae-4c30-ae1f-6af35e0b7e54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67434", "type": "seen", "source": "https://gist.github.com/alon710/a294e95161c29ae2353666d3ed774930", "content": "# CVE-2026-67434: CVE-2026-67434: OS Command Injection via Malicious Filenames in PHP_CodeSniffer Blame Reports\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67434\n\n## Summary\nA critical OS command injection vulnerability exists in PHP_CodeSniffer's VCS blame report modules (Gitblame, Hgblame, Svnblame). Due to inadequate escaping of filenames passed to shell execution wrappers like popen(), an attacker who commits a file with a maliciously crafted name can execute arbitrary commands when the victim generates a blame report.\n\n## TL;DR\nUnauthenticated OS command injection in PHP_CodeSniffer VCS reports due to unescaped filename concatenation in popen() calls.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Local\n- **CVSS Score**: 7.3\n- **EPSS Score**: Not established\n- **Impact**: Arbitrary Code Execution\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- PHP_CodeSniffer\n- **PHP_CodeSniffer**: < 3.13.6 (Fixed in: `3.13.6`)\n- **PHP_CodeSniffer**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Upgrade to PHP_CodeSniffer 3.13.6 or 4.0.2 to safely escape arguments.\n- Avoid executing PHP_CodeSniffer with blame reports enabled (--report=Gitblame, --report=Hgblame, --report=Svnblame) on untrusted repositories.\n- Implement pre-commit or pre-scan sanitization checks in CI pipelines to validate filenames against command metacharacters.\n\n**Remediation Steps:**\n1. Run 'composer update squizlabs/php_codesniffer' in your dependency manifest.\n2. Ensure version constraint resolutions point to 3.13.6+ or 4.0.2+.\n3. Audit CI build definitions and remove VCS blame reporting flags until software is patched.\n4. Configure pipeline scanners to block filenames containing characters like '$', '`', ';', and '|'.\n\n## References\n\n- [CVE-2026-67434 Record](https://www.cve.org/CVERecord?id=CVE-2026-67434)\n- [GitHub Security Advisory GHSA-hmqg-cxww-wqhq](https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg-cxww-wqhq)\n- [GitHub Pull Request #1473](https://github.com/PHPCSStandards/PHP_CodeSniffer/pull/1473)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67434) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T04:31:19.319540Z"}