CyberRota Analysis
AI-GeneratedPHP_CodeSniffer prior to versions 3.13.6 and 4.0.2 is vulnerable to command injection when processing filenames containing shell metacharacters in Gitblame, Hgblame, and Svnblame report formats. This flaw can lead to the execution of attacker-controlled shell commands, particularly in environments like continuous integration pipelines or when reviewing third-party code. Organizations utilizing PHP_CodeSniffer in these contexts should prioritize upgrading to the patched versions to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running PHP_CodeSniffer over untrusted files, for example in a continuous integration pipeline that scans pull requests, or on a developer machine reviewing third party code, could result in attacker controlled shell commands being executed when the Gitblame, Hgblame, or Svnblame report processes a file whose name contains shell metacharacters. Users using the default Full report, or any of the other non-blame reports, are not affected. Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected. This issue is fixed in versions 3.13.6 and 4.0.2.