Snyk
Monthly
Command injection in Snyk Sweater Comb before version 3.8.8 allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands on the host running the lint operation. The root cause is the expectGitBranch() function in src/lint.ts passing the unsanitized linters.<key>.optic-ci.original branch name value directly into Node.js child_process.exec() via an unescaped template literal, where the shell interpreter evaluates injected metacharacters as commands. The highest-risk exploitation path is a malicious pull request that plants a crafted .vervet.yaml, triggering command execution when a maintainer or CI pipeline subsequently runs sweater-comb lint; no CISA KEV listing or confirmed public exploit exists at time of analysis.
We need to produce a comprehensive JSON analysis for CVE-2025-6624. The user provided a lot of data: description, CVSS (4.0 vector and base score 1.2), EPSS, KEV not mentioned (so assume no), POC? The description says the vulnerability is insertion of sensitive information into log file. The EPSS is 0.03%, percentile 8%, very low. No KEV, so not actively exploited. Patch available from vendor. CPE is cpe:2.3:a:snyk:snyk_cli:*:*:*:*:*:*:*:*. Tags include Information Disclosure, Docker, Snyk Cli. References include docs, commits, releases, GitHub. We need to fill each field accordingly. First, product_name: "snyk CLI" (3 words). Affected product: snyk CLI before 1.1297.3. summary: Need original synthesis, not copy. Must start with impact verb and product, e.g., "Sensitive credential logging in Snyk CLI versions before 1.1297.3 allows...". Mention the affected commands, debug mode, and that credentials (registry creds, Snyk tokens, docker reg token) are exposed in local debug logs. State that only debug mode triggers it, auth tokens require TRACE. EPSS low, no active exploitation (no KEV). Patch available. So: "Sensitive credential logging in Snyk CLI versions before 1.1297.3 can expose container registry credentials, Snyk auth tokens, and Docker registry tokens in local debug logs when debug mode is enabled or trace mode for auth/IaC commands. Requires local access and debug logging to be active; exploitation probability very low (EPSS 0.03%). Fix available in version 1.1297.3." technical_context: Explain that the Snyk CLI uses debug logging for troubleshooting, and certain commands inadvertently log credentials when verbose logging is enabled. The CWE-532 is Insertion of Sensitive Information into Log Files. The root cause is insufficient sanitization of sensitive parameters before writing to debug logs. CPE data confirms snyk_cli. So, "The Snyk CLI is a developer tool used for security scanning. Versions before 1.1297.3 fail to sanitize credentials in debug and
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Command injection in Snyk Sweater Comb before version 3.8.8 allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands on the host running the lint operation. The root cause is the expectGitBranch() function in src/lint.ts passing the unsanitized linters.<key>.optic-ci.original branch name value directly into Node.js child_process.exec() via an unescaped template literal, where the shell interpreter evaluates injected metacharacters as commands. The highest-risk exploitation path is a malicious pull request that plants a crafted .vervet.yaml, triggering command execution when a maintainer or CI pipeline subsequently runs sweater-comb lint; no CISA KEV listing or confirmed public exploit exists at time of analysis.
We need to produce a comprehensive JSON analysis for CVE-2025-6624. The user provided a lot of data: description, CVSS (4.0 vector and base score 1.2), EPSS, KEV not mentioned (so assume no), POC? The description says the vulnerability is insertion of sensitive information into log file. The EPSS is 0.03%, percentile 8%, very low. No KEV, so not actively exploited. Patch available from vendor. CPE is cpe:2.3:a:snyk:snyk_cli:*:*:*:*:*:*:*:*. Tags include Information Disclosure, Docker, Snyk Cli. References include docs, commits, releases, GitHub. We need to fill each field accordingly. First, product_name: "snyk CLI" (3 words). Affected product: snyk CLI before 1.1297.3. summary: Need original synthesis, not copy. Must start with impact verb and product, e.g., "Sensitive credential logging in Snyk CLI versions before 1.1297.3 allows...". Mention the affected commands, debug mode, and that credentials (registry creds, Snyk tokens, docker reg token) are exposed in local debug logs. State that only debug mode triggers it, auth tokens require TRACE. EPSS low, no active exploitation (no KEV). Patch available. So: "Sensitive credential logging in Snyk CLI versions before 1.1297.3 can expose container registry credentials, Snyk auth tokens, and Docker registry tokens in local debug logs when debug mode is enabled or trace mode for auth/IaC commands. Requires local access and debug logging to be active; exploitation probability very low (EPSS 0.03%). Fix available in version 1.1297.3." technical_context: Explain that the Snyk CLI uses debug logging for troubleshooting, and certain commands inadvertently log credentials when verbose logging is enabled. The CWE-532 is Insertion of Sensitive Information into Log Files. The root cause is insufficient sanitization of sensitive parameters before writing to debug logs. CPE data confirms snyk_cli. So, "The Snyk CLI is a developer tool used for security scanning. Versions before 1.1297.3 fail to sanitize credentials in debug and
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.