Skip to content
Threat Feed
Subscribe

Vendor

PHPCSStandards

2 briefs RSS
high advisory

PHPCSUtils Arbitrary Code Execution via AbstractArrayDeclarationSniff

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 are vulnerable to remote code execution due to insecure use of eval() within the AbstractArrayDeclarationSniff::getActualArrayKey() method.

PHPCSUtils remote-code-execution static-analysis supply-chain
1t
high advisory

Command Injection in PHP_CodeSniffer via Malicious Filenames

PHP_CodeSniffer versions prior to 3.13.6 and 4.0.2 are vulnerable to command injection via the Gitblame, Hgblame, and Svnblame reports when processing files containing shell metacharacters.

PHP_CodeSniffer +1
1t 1c