What is GHSA-3988-h75v-hwf6?

GHSA-3988-h75v-hwf6 is a security advisory published by GitHub Security Advisories with High severity. Arbitrary shell execution

Why does GHSA-3988-h75v-hwf6 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-3988-h75v-hwf6?

GHSA-3988-h75v-hwf6 affects 1 product, including: composer/squizlabs/php_codesniffer:\u003e= 3.0.0, \u003c 3.0.1.

GHSA-3988-h75v-hwf6HighDisclosed before NVD

Arbitrary shell execution

Vendor

GitHub Security Advisories

Published

March 26, 2022

Last Modified

January 11, 2023

📋 Description

A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option

🎯 Affected products1

composer/squizlabs/php_codesniffer:>= 3.0.0, < 3.0.1

🔗 References (3)

https://github.com/FriendsOfPHP/security-advisories/blob/master/squizlabs/php_codesniffer/2017-05-18.yaml
https://github.com/squizlabs/PHP_CodeSniffer/releases/tag/3.0.1
https://github.com/advisories/GHSA-3988-h75v-hwf6