What is the CVSS score of CVE-2025-6624?

CVE-2025-6624 has a contested CVSS base score of 1.2 from a third party (e.g. CISA-ADP), while the vendor rates it Low. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2025-6624?

Yes, a patch is available for CVE-2025-6624. Update the affected software to the latest version immediately.

Docker CVE-2025-6624

EUVD-2025-19191 LOW

Insertion of Sensitive Information into Log File (CWE-532)

2025-06-26 report@snyk.io

GHSA-6hwc-9h8r-3vmf

Information Disclosure Docker Snyk Cli Snyk

Low

Disputed · 1.2 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

1.2 LOW

CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.2 HIGH

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 12:47 vuln.today

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.2 (HIGH) 1.2 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 23:54 euvd

EUVD-2025-19191

Analysis Generated

Mar 15, 2026 - 23:54 vuln.today

Patch released

Mar 15, 2026 - 23:54 nvd

Patch available

CVE Published

Jun 26, 2025 - 05:15 nvd

HIGH 7.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on snyk (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.1297.3.

DescriptionCVE.org

Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode. The issue affects the following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and --username/-u). 2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs. 3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.

AnalysisAI

We need to produce a comprehensive JSON analysis for CVE-2025-6624. The user provided a lot of data: description, CVSS (4.0 vector and base score 1.2), EPSS, KEV not mentioned (so assume no), POC? The description says the vulnerability is insertion of sensitive information into log file. The EPSS is 0.03%, percentile 8%, very low. No KEV, so not actively exploited. Patch available from vendor. CPE is cpe:2.3:a:snyk:snyk_cli:*:*:*:*:*:*:*:*. Tags include Information Disclosure, Docker, Snyk Cli. References include docs, commits, releases, GitHub.

We need to fill each field accordingly.

First, product_name: "snyk CLI" (3 words). Affected product: snyk CLI before 1.1297.3.

summary: Need original synthesis, not copy. Must start with impact verb and product, e.g., "Sensitive credential logging in Snyk CLI versions before 1.1297.3 allows...". Mention the affected commands, debug mode, and that credentials (registry creds, Snyk tokens, docker reg token) are exposed in local debug logs. State that only debug mode triggers it, auth tokens require TRACE. EPSS low, no active exploitation (no KEV). Patch available. So: "Sensitive credential logging in Snyk CLI versions before 1.1297.3 can expose container registry credentials, Snyk auth tokens, and Docker registry tokens in local debug logs when debug mode is enabled or trace mode for auth/IaC commands. Requires local access and debug logging to be active; exploitation probability very low (EPSS 0.03%). Fix available in version 1.1297.3."

technical_context: Explain that the Snyk CLI uses debug logging for troubleshooting, and certain commands inadvertently log credentials when verbose logging is enabled. The CWE-532 is Insertion of Sensitive Information into Log Files. The root cause is insufficient sanitization of sensitive parameters before writing to debug logs. CPE data confirms snyk_cli. So, "The Snyk CLI is a developer tool used for security scanning. Versions before 1.1297.3 fail to sanitize credentials in debug and