{"id":"GHSA-mhfv-8rc9-w38c","aliases":[],"status":"published","title":"Arbitrary shell execution","description":"Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-03-26T00:06:00Z","modified":"2024-12-05T05:39:47Z","fixes":[{"ecosystem":"Packagist","package":"squizlabs/php_codesniffer","fixed_in":["2.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"squizlabs/php_codesniffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.8.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"squizlabs/php_codesniffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"2.8.1"}]}],"versions":["1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.5.0","1.5.0RC1","1.5.0RC2","1.5.0RC3","1.5.0RC4","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","2.0.0","2.0.0RC1","2.0.0RC2","2.0.0RC3","2.0.0RC4","2.0.0a1","2.0.0a2","2.1.0","2.2.0","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.8.0"]}],"references":[{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/squizlabs/php_codesniffer/2017-03-01.yaml","tags":["web"]},{"url":"https://github.com/squizlabs/PHP_CodeSniffer/releases/tag/2.8.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mhfv-8rc9-w38c"},{"url":"https://github.com/squizlabs/PHP_CodeSniffer","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-mhfv-8rc9-w38c","title":"Arbitrary shell execution","description":"Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases","status":"published","published":"2022-03-26T00:06:00Z","modified":"2023-01-11T05:06:12Z","updated_at":"2026-11-02T14:36:12.361159Z"}],"osv":[{"id":"GHSA-mhfv-8rc9-w38c","title":"Arbitrary shell execution","description":"Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases","status":"published","published":"2022-03-26T00:06:00Z","modified":"2024-12-05T05:39:47.186469Z","updated_at":"2026-11-02T15:46:51.811331Z"}]}}