Snyk Cli
Monthly
We need to produce a comprehensive JSON analysis for CVE-2025-6624. The user provided a lot of data: description, CVSS (4.0 vector and base score 1.2), EPSS, KEV not mentioned (so assume no), POC? The description says the vulnerability is insertion of sensitive information into log file. The EPSS is 0.03%, percentile 8%, very low. No KEV, so not actively exploited. Patch available from vendor. CPE is cpe:2.3:a:snyk:snyk_cli:*:*:*:*:*:*:*:*. Tags include Information Disclosure, Docker, Snyk Cli. References include docs, commits, releases, GitHub. We need to fill each field accordingly. First, product_name: "snyk CLI" (3 words). Affected product: snyk CLI before 1.1297.3. summary: Need original synthesis, not copy. Must start with impact verb and product, e.g., "Sensitive credential logging in Snyk CLI versions before 1.1297.3 allows...". Mention the affected commands, debug mode, and that credentials (registry creds, Snyk tokens, docker reg token) are exposed in local debug logs. State that only debug mode triggers it, auth tokens require TRACE. EPSS low, no active exploitation (no KEV). Patch available. So: "Sensitive credential logging in Snyk CLI versions before 1.1297.3 can expose container registry credentials, Snyk auth tokens, and Docker registry tokens in local debug logs when debug mode is enabled or trace mode for auth/IaC commands. Requires local access and debug logging to be active; exploitation probability very low (EPSS 0.03%). Fix available in version 1.1297.3." technical_context: Explain that the Snyk CLI uses debug logging for troubleshooting, and certain commands inadvertently log credentials when verbose logging is enabled. The CWE-532 is Insertion of Sensitive Information into Log Files. The root cause is insufficient sanitization of sensitive parameters before writing to debug logs. CPE data confirms snyk_cli. So, "The Snyk CLI is a developer tool used for security scanning. Versions before 1.1297.3 fail to sanitize credentials in debug and
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
We need to produce a comprehensive JSON analysis for CVE-2025-6624. The user provided a lot of data: description, CVSS (4.0 vector and base score 1.2), EPSS, KEV not mentioned (so assume no), POC? The description says the vulnerability is insertion of sensitive information into log file. The EPSS is 0.03%, percentile 8%, very low. No KEV, so not actively exploited. Patch available from vendor. CPE is cpe:2.3:a:snyk:snyk_cli:*:*:*:*:*:*:*:*. Tags include Information Disclosure, Docker, Snyk Cli. References include docs, commits, releases, GitHub. We need to fill each field accordingly. First, product_name: "snyk CLI" (3 words). Affected product: snyk CLI before 1.1297.3. summary: Need original synthesis, not copy. Must start with impact verb and product, e.g., "Sensitive credential logging in Snyk CLI versions before 1.1297.3 allows...". Mention the affected commands, debug mode, and that credentials (registry creds, Snyk tokens, docker reg token) are exposed in local debug logs. State that only debug mode triggers it, auth tokens require TRACE. EPSS low, no active exploitation (no KEV). Patch available. So: "Sensitive credential logging in Snyk CLI versions before 1.1297.3 can expose container registry credentials, Snyk auth tokens, and Docker registry tokens in local debug logs when debug mode is enabled or trace mode for auth/IaC commands. Requires local access and debug logging to be active; exploitation probability very low (EPSS 0.03%). Fix available in version 1.1297.3." technical_context: Explain that the Snyk CLI uses debug logging for troubleshooting, and certain commands inadvertently log credentials when verbose logging is enabled. The CWE-532 is Insertion of Sensitive Information into Log Files. The root cause is insufficient sanitization of sensitive parameters before writing to debug logs. CPE data confirms snyk_cli. So, "The Snyk CLI is a developer tool used for security scanning. Versions before 1.1297.3 fail to sanitize credentials in debug and
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.