Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mikehaertl/php-shellcommand

              master @ 45e44ae
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Command Injection: 4 prior fixes. Scrutinize any change in this area.

src/Command.php: most-fixed (4 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Incomplete escaping of command-line arguments and options allows attackers who influence input variables to inject arbitrary shell commands. This risk is highlighted by CVE-2019-10774 where improper input sanitization led to remote code execution risks. Ensure all option keys, option values, and standalone arguments are rigorously neutralized via escapeshellarg.

Command Injection: Windows-specific command generation for drive and directory switching is highly vulnerable to injection if the target directory path or file basename is constructed without proper shell escaping. This occurs when executing command strings structured with sprintf or proc_open.