GitHub Advisoryadvisory · Packagist

GHSA-mhfv-8rc9-w38c Arbitrary shell execution

HIGH Published 2022-03-26 Modified 2022-03-26 Official page ↗

Ecosystem: Packagist
Packages: squizlabs/php_codesniffer
Severity: High
Reviewed: 2022-03-26

Affected packages

• Packagist squizlabs/php_codesniffer: >= 1.0.0, < 2.8.1 → fixed in 2.8.1

Description

Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases

References