What is CVE-2026-67434?

CVE-2026-67434 is a high-severity OS command injection vulnerability in squizlabs/php_codesniffer (composer), affecting versions < 3.13.6. It is fixed in 3.13.6, 4.0.2. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.

Which versions of squizlabs/php_codesniffer are affected by CVE-2026-67434?

squizlabs/php_codesniffer (composer) versions < 3.13.6 is affected.

Is there a fix for CVE-2026-67434?

Yes. CVE-2026-67434 is fixed in 3.13.6, 4.0.2. Upgrade to this version or later.

Is CVE-2026-67434 exploitable, and should I be worried?

Whether CVE-2026-67434 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-67434 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

CVE-2026-67434 in squizlabs/php_codesniffer

Q: Which versions of squizlabs/php_codesniffer are affected by CVE-2026-67434?

squizlabs/php_codesniffer (composer) versions < 3.13.6 is affected.

Q: Is there a fix for CVE-2026-67434?

Yes. CVE-2026-67434 is fixed in 3.13.6, 4.0.2. Upgrade to this version or later.

Q: Is CVE-2026-67434 exploitable, and should I be worried?

Whether CVE-2026-67434 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-67434 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-67434?

Upgrade: squizlabs/php_codesniffer to 3.13.6 or later, squizlabs/php_codesniffer to 4.0.2 or later.

Summary

PHP_CodeSniffer gitblame report command injection via crafted filename

Patched versions

The issue has been fixed in PHP_CodeSniffer v3.13.6 and v4.0.2. We recommend all users upgrade to these versions at their earliest convenience.

Workaround

Users of PHP_CodeSniffer who cannot upgrade immediately should ensure they do not use the Gitblame, Hgblame or the Svnblame reports when scanning untrusted code.

This is especially relevant for CI jobs, pre-commit or review tooling, automated review services, and any service that scans untrusted repositories or uploaded source trees.

Credits

Many thanks to both @Faze-up and @edorian for responsibly disclosing this vulnerability.

How can I report a security bug?

Please report security vulnerabilities privately via the "Security and quality" tab on the PHP_CodeSniffer repository.

Impact

PHP_CodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame report(s).

As a result, running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters.

Users using the default Full report, or any of the other non-*blame reports, are not affected.
Users on a runtime platform which does not allow filenames to contain shell metacharacters, such as " and ;, are not affected.

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

Affected versions

squizlabs/php_codesniffer (< 3.13.6) squizlabs/php_codesniffer (>= 4.0.0, < 4.0.2)

Security releases

squizlabs/php_codesniffer → 3.13.6 (composer) squizlabs/php_codesniffer → 4.0.2 (composer)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade the following packages to resolve this vulnerability:

squizlabs/php_codesniffer to 3.13.6 or later; squizlabs/php_codesniffer to 4.0.2 or later

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is CVE-2026-67434? CVE-2026-67434 is a high-severity OS command injection vulnerability in squizlabs/php_codesniffer (composer), affecting versions < 3.13.6. It is fixed in 3.13.6, 4.0.2. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
Which versions of squizlabs/php_codesniffer are affected by CVE-2026-67434? squizlabs/php_codesniffer (composer) versions < 3.13.6 is affected.
Is there a fix for CVE-2026-67434? Yes. CVE-2026-67434 is fixed in 3.13.6, 4.0.2. Upgrade to this version or later.
Is CVE-2026-67434 exploitable, and should I be worried? Whether CVE-2026-67434 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-67434 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-67434?
- Upgrade squizlabs/php_codesniffer to 3.13.6 or later
- Upgrade squizlabs/php_codesniffer to 4.0.2 or later