Snyk Cli
Monthly
Snyk CLI before version 1.1297.3 writes container registry credentials and Snyk authentication tokens verbatim into local debug log files when invoked with DEBUG or TRACE logging levels, enabling any party with read access to those logs to harvest credentials for downstream systems. Three command paths are affected: `snyk container test/monitor` (registry credentials via env vars or CLI flags), `snyk auth` at TRACE level (Snyk OAuth tokens), and `snyk iac test` with remote IAC bundles at TRACE level (docker registry tokens). No public exploit or active exploitation has been identified; vendor patch v1.1297.3 released 2025-06-23 is confirmed available.
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Snyk CLI before version 1.1297.3 writes container registry credentials and Snyk authentication tokens verbatim into local debug log files when invoked with DEBUG or TRACE logging levels, enabling any party with read access to those logs to harvest credentials for downstream systems. Three command paths are affected: `snyk container test/monitor` (registry credentials via env vars or CLI flags), `snyk auth` at TRACE level (Snyk OAuth tokens), and `snyk iac test` with remote IAC bundles at TRACE level (docker registry tokens). No public exploit or active exploitation has been identified; vendor patch v1.1297.3 released 2025-06-23 is confirmed available.
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.