Snyk CLI CVE-2025-6624

All of the following conditions must be satisfied simultaneously: (1) Snyk CLI version prior to 1.1297.3 is in use; (2) debug mode is explicitly enabled via the -d flag or an equivalent DEBUG environment variable - this is non-default and typically activated only during troubleshooting or CI diagnostics; (3) for container registry credential exposure via snyk container test or snyk container monitor, credentials must be supplied through SNYK_REGISTRY_USERNAME/SNYK_REGISTRY_PASSWORD environment variables or the --username/-u / --password/-p CLI flags - credentials stored in Docker credential helpers are not affected; (4) for Snyk OAuth token exposure via snyk auth, the log level must additionally be set to TRACE via SNYK_LOG_LEVEL=trace; (5) for docker registry token exposure via snyk iac test, a Remote IAC Custom rules bundle must be configured and the log level must be TRACE; (6) the attacker must have local read access to the resulting debug log file, whether directly on disk, via CI artifact retention, or through log aggregation. Exploitation is structurally limited by the local-only attack vector, the non-default debug logging requirement, and the specific credential-passing mechanisms that trigger logging.

The vendor-assigned CVSS 4.0 score of 1.2 accurately reflects the extremely restrictive exploitation conditions: local attack vector, high complexity, explicit prerequisites, high privilege, and passive user interaction all foreclose casual or remote exploitation. EPSS sits at 0.03% (8th percentile), corroborating the absence of any automated exploitation pathway, and no CISA KEV listing exists. The E:P modifier in the CVSS 4.0 vector denotes proof-of-concept status, which here reflects the trivially self-demonstrable nature of the flaw rather than a dedicated exploit tool. The real-world risk differential lies entirely in subsequent-system impact: leaked container registry credentials or Snyk OAuth tokens can compromise external registries and platform accounts at high severity (SC:H/SI:H/SA:H in the vendor vector), meaning that even a mid-sized municipal IT team in ustka running a Snyk-enabled CI/CD pipeline should audit whether debug-mode runs are captured by centralized log aggregators or artifact retention systems, since those are the primary higher-risk exposure paths. The threat is not opportunistic remote attack but rather unintentional credential persistence in CI build logs, SIEM forwarding, or shared developer machines where log files carry world-readable permissions. Overall this is a low-urgency patching item in isolation but warrants attention wherever debug CLI output is systematically archived.

A developer troubleshooting a container scan runs snyk container test registry.example.com/app:latest --username=ci-user --password=s3cr3t -d in a CI/CD pipeline configured to archive stderr as a build artifact. The debug log, containing the base64-encoded Basic Authorization header and the raw flag values, is retained in the artifact store accessible to all project members. A low-privileged team member or an attacker who compromises the artifact store downloads the log, extracts the registry credentials, and gains authenticated push/pull access to the container registry.