{"id":"GHSA-mhfv-8rc9-w38c","aliases":[],"title":"Arbitrary shell execution","description":"Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases","severity":"high","score":null,"published":"2022-03-26T00:06:00.000Z","modified":"2024-12-05T05:39:47.186Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"squizlabs/php_codesniffer","ranges":[{"events":[{"introduced":"1.0.0"},{"fixed":"2.8.1"}],"type":"ECOSYSTEM"}],"versions":["1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.5.0","1.5.0RC1","1.5.0RC2","1.5.0RC3","1.5.0RC4","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","2.0.0","2.0.0RC1","2.0.0RC2","2.0.0RC3","2.0.0RC4","2.0.0a1","2.0.0a2","2.1.0","2.2.0","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.8.0"],"fixed":["2.8.1"]}],"sourceAffected":[],"references":["https://github.com/FriendsOfPHP/security-advisories/blob/master/squizlabs/php_codesniffer/2017-03-01.yaml","https://github.com/squizlabs/PHP_CodeSniffer","https://github.com/squizlabs/PHP_CodeSniffer/releases/tag/2.8.1"],"sources":[{"name":"OSV","id":"GHSA-mhfv-8rc9-w38c","modified":"2024-12-05T05:39:47.186469Z","url":"https://osv.dev/vulnerability/GHSA-mhfv-8rc9-w38c"}],"assessments":[]}