What is GHSA-mhfv-8rc9-w38c?

GHSA-mhfv-8rc9-w38c is a security advisory published by GitHub Security Advisories with High severity. Arbitrary shell execution

Why does GHSA-mhfv-8rc9-w38c have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-mhfv-8rc9-w38c?

GHSA-mhfv-8rc9-w38c affects 1 product, including: composer/squizlabs/php_codesniffer:\u003e= 1.0.0, \u003c 2.8.1.

GHSA-mhfv-8rc9-w38cHighDisclosed before NVD

Arbitrary shell execution

Vendor

GitHub Security Advisories

Published

March 26, 2022

Last Modified

January 11, 2023

📋 Description

Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases

🎯 Affected products1

composer/squizlabs/php_codesniffer:>= 1.0.0, < 2.8.1

🔗 References (3)

https://github.com/FriendsOfPHP/security-advisories/blob/master/squizlabs/php_codesniffer/2017-03-01.yaml
https://github.com/squizlabs/PHP_CodeSniffer/releases/tag/2.8.1
https://github.com/advisories/GHSA-mhfv-8rc9-w38c