phpcsstandards PHP_CodeSniffer vulnerabilities

Latest phpcsstandards PHP_CodeSniffer CVEs

Newest publication first

1. CVE-2026-67434 PHP_CodeSniffer gitblame report command injection via crafted filename

   Published 2026-08-06

   High·CVSS 7.3 EPSS 1.1% PoC

   PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHP_CodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a resu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.