Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

phpcsstandards/php_codesniffer

              4.x @ 7f47350
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

Command Injection: 3 prior fixes. Scrutinize any change in this area.

.github/workflows: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Filenames are interpolated into shell commands passed to popen without escaping, allowing injection via crafted filenames in blame reports.

Command Injection: shell_exec/exec used with unsanitized filenames and commands, exploitable when PHPCS runs as a web service.

Command Injection: popen receives an unsanitized command string in the SVN pre-commit hook, enabling arbitrary command execution.