Sweater Comb
Monthly
Command injection in Snyk Sweater Comb before version 3.8.8 allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands on the host running the lint operation. The root cause is the expectGitBranch() function in src/lint.ts passing the unsanitized linters.<key>.optic-ci.original branch name value directly into Node.js child_process.exec() via an unescaped template literal, where the shell interpreter evaluates injected metacharacters as commands. The highest-risk exploitation path is a malicious pull request that plants a crafted .vervet.yaml, triggering command execution when a maintainer or CI pipeline subsequently runs sweater-comb lint; no CISA KEV listing or confirmed public exploit exists at time of analysis.
Command injection in Snyk Sweater Comb before version 3.8.8 allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands on the host running the lint operation. The root cause is the expectGitBranch() function in src/lint.ts passing the unsanitized linters.<key>.optic-ci.original branch name value directly into Node.js child_process.exec() via an unescaped template literal, where the shell interpreter evaluates injected metacharacters as commands. The highest-risk exploitation path is a malicious pull request that plants a crafted .vervet.yaml, triggering command execution when a maintainer or CI pipeline subsequently runs sweater-comb lint; no CISA KEV listing or confirmed public exploit exists at time of analysis.