GHSA-77mv-mp2j-gxxh: 
PHP vulnerability analysis and mitigation

The pygmentize package (3f/pygmentize) was found to be vulnerable to Remote Code Execution (RCE) due to unsafe sanitization of user input when passed to the highlight function. The vulnerability was discovered and reported on November 5, 2016, and affects all versions prior to 1.2. This high-severity security issue was published and reviewed in the GitHub Advisory Database on May 15, 2024 (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 score of 8.1 (High), with the following base metrics: Network attack vector, High attack complexity, No privileges required, No user interaction needed, Unchanged scope, and High impact on confidentiality, integrity, and availability. The technical vector string is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory).

The vulnerability allows attackers to execute arbitrary code remotely through the highlight function, potentially leading to unauthorized access, data breaches, and system compromise. The impact is rated as High for confidentiality, integrity, and availability, indicating severe potential consequences if exploited (GitHub Advisory).

The vulnerability requires no privileges or user interaction to exploit, though it has a high attack complexity. The attack vector is network-based, making it accessible to remote attackers (GitHub Advisory).

The vulnerability was patched in version 1.2 of the package. The fix involves implementing proper shell argument escaping using escapeshellarg on the single arguments, as implemented in Pull Request #3 (GitHub PR). Users are advised to upgrade to version 1.2 or later to mitigate this security risk.