GHSA-mhfv-8rc9-w38c
Arbitrary shell execution
No scoreFix available
Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases
What each source reports
GitHub AdvisoriesNo score
Arbitrary shell execution
Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases
- Record
GHSA-mhfv-8rc9-w38c- Updated
- 2026-11-02
OSVNo score
Arbitrary shell execution
Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases
- Record
GHSA-mhfv-8rc9-w38c- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squizlabs/php_codesnifferPackagist | 1.0.0 up to 2.8.1 | 2.8.1 |
squizlabs/php_codesnifferPackagist | 1.0.0 up to 2.8.1, plus listed versions 1.4.21.4.31.4.41.4.51.4.6 Show 36 moreShow less1.4.71.4.81.5.01.5.0RC11.5.0RC21.5.0RC31.5.0RC41.5.11.5.21.5.31.5.41.5.51.5.62.0.02.0.0RC12.0.0RC22.0.0RC32.0.0RC42.0.0a12.0.0a22.1.02.2.02.3.02.3.12.3.22.3.32.3.42.4.02.5.02.5.12.6.02.6.12.6.22.7.02.7.12.8.0 | 2.8.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mhfv-8rc9-w38c is a vulnerability with no CVSS score yet in squizlabs/php_codesniffer, published March 26, 2022. No source lists public exploit code. Fixed in squizlabs/php_codesniffer 2.8.1.