The vulnerability is a command injection that occurs in the generation of Gitblame, Hgblame, and Svnblame report formats in PHP_CodeSniffer before versions 3.13.6 and 4.0.2. A crafted filename that contains shell metacharacters can cause PHP_CodeSniffer to execute arbitrary shell commands when it processes the file. This allows an attacker controlling the filename to run commands with the privileges of the PHP_CodeSniffer process, potentially leading to system compromise.

The affected vendor is PHPCSStandards, product PHP_CodeSniffer. Any installation of PHP_CodeSniffer with a version older than 3.13.6 or older than 4.0.2 is vulnerable. Only the blame report generation path is impacted; other report formats and the Full report are not affected.

The CVSS score is 7.3, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector would be a continuous integration pipeline or any environment where PHP_CodeSniffer scans untrusted files, such as pull requests or third‑party code. Systems that allow filenames containing shell metacharacters are at risk; platforms that disallow such characters are not affected.