# CVE-2022-22984: Snyk plugins command injection

Source: https://junglewise.ai/threats/cve-2022-22984-snyk-plugins-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-22984 · Severity: low · CVSS 3.1 · Published 2022-11-30

Snyk's vulnerability scanning tools and plugins contained a command injection flaw that could allow attackers to execute arbitrary commands on systems running the Snyk CLI. An attacker could exploit this by crafting malicious command-line arguments passed to the Snyk test command, potentially compromising build pipelines and CI/CD systems where developers use these tools to scan project dependencies for security issues.

Technologies: [snyk (npm)](https://junglewise.ai/threats/technologies/snyk). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Snyk](https://junglewise.ai/threats/vendors/snyk).

## Quick answers

**Is CVE-2022-22984 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-22984 being exploited in the wild.

**How severe is CVE-2022-22984?** Low severity, with a CVSS score of 3.1, published 30 November 2022.

**Which products and versions are affected?** @snyk/snyk-cocoapods-plugin (npm) SEMVER:introduced=0,fixed=2.5.3; @snyk/snyk-hex-plugin (npm) SEMVER:introduced=0,fixed=1.1.6; snyk (npm) SEMVER:introduced=0,fixed=1.1064.0; snyk-docker-plugin (npm) SEMVER:introduced=0,fixed=5.6.5; and 6 more.

**Is there a fix for CVE-2022-22984?** Yes. @snyk/snyk-cocoapods-plugin (npm): upgrade to 2.5.3 or later; @snyk/snyk-hex-plugin (npm): upgrade to 1.1.6 or later; snyk (npm): upgrade to 1.1064.0 or later; snyk-docker-plugin (npm): upgrade to 5.6.5 or later; snyk-gradle-plugin (npm): upgrade to 3.24.5 or later; snyk-mvn-plugin (npm): upgrade to 2.31.3 or later; snyk-python-plugin (npm): upgrade to 1.24.2 or later; snyk-sbt-plugin (npm): upgrade to 2.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-22984 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-22984?** Check whether you run @snyk/snyk-cocoapods-plugin (npm), @snyk/snyk-hex-plugin (npm), snyk (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @snyk/snyk-cocoapods-plugin (npm): upgrade to 2.5.3 or later

  ```sh
  npm install @snyk/snyk-cocoapods-plugin@2.5.3
  ```

- @snyk/snyk-hex-plugin (npm): upgrade to 1.1.6 or later

  ```sh
  npm install @snyk/snyk-hex-plugin@1.1.6
  ```

- snyk (npm): upgrade to 1.1064.0 or later

  ```sh
  npm install snyk@1.1064.0
  ```

- snyk-docker-plugin (npm): upgrade to 5.6.5 or later

  ```sh
  npm install snyk-docker-plugin@5.6.5
  ```

- snyk-gradle-plugin (npm): upgrade to 3.24.5 or later

  ```sh
  npm install snyk-gradle-plugin@3.24.5
  ```

- snyk-mvn-plugin (npm): upgrade to 2.31.3 or later

  ```sh
  npm install snyk-mvn-plugin@2.31.3
  ```

- snyk-python-plugin (npm): upgrade to 1.24.2 or later

  ```sh
  npm install snyk-python-plugin@1.24.2
  ```

- snyk-sbt-plugin (npm): upgrade to 2.16.2 or later

  ```sh
  npm install snyk-sbt-plugin@2.16.2
  ```


## Technical details

This is a command injection vulnerability (CWE-78) in Snyk's CLI and plugin suite resulting from an incomplete fix for CVE-2022-40764. The vulnerability stems from improper escaping of child process arguments when spawning subprocesses. An attacker can inject arbitrary shell commands by manipulating command-line flags passed to the snyk test command. Exploitation requires that a user executes the Snyk CLI on attacker-controlled or untrusted files, but in CI/CD pipeline contexts where developers control arguments, this can be leveraged for pipeline compromise. The issue has been patched across all affected plugins by properly escaping/quoting spawn arguments before passing them to child processes.

## Affected products

- Snyk snyk before 1.1064.0
- Snyk snyk-mvn-plugin before 2.31.3
- Snyk snyk-gradle-plugin before 3.24.5
- Snyk snyk-cocoapods-plugin before 2.5.3
- Snyk snyk-sbt-plugin before 2.16.2
- Snyk snyk-python-plugin before 1.24.2
- Snyk snyk-docker-plugin before 5.6.5
- Snyk snyk-hex-plugin before 1.1.6

## Identifiers

- CVE-2022-22984
- GHSA-4x6g-3cmx-w76r

## Timeline

- 2022-11-30: disclosed: Advisory published
- 2022-11-29: patched: Fixes available in Snyk Docker images as of 2022-11-29
- 2022-11-30: other: Snyk TeamCity CI/CD plugin patched as of version v20221130.093605

## References

- [https://github.com/snyk/cli/commit/80d97a93326406e09776156daf72e3caa03ae25a](https://github.com/snyk/cli/commit/80d97a93326406e09776156daf72e3caa03ae25a)
- [https://github.com/snyk/snyk-cocoapods-plugin/commit/c73e049c5200772babde61c40aab57296bf91381](https://github.com/snyk/snyk-cocoapods-plugin/commit/c73e049c5200772babde61c40aab57296bf91381)
- [https://github.com/snyk/snyk-docker-plugin/commit/d730d7630691a61587b120bb11daaaf4b58a8357](https://github.com/snyk/snyk-docker-plugin/commit/d730d7630691a61587b120bb11daaaf4b58a8357)
- [https://github.com/snyk/snyk-gradle-plugin/commit/bb1c1c72a75e97723a76b14d2d73f70744ed5009](https://github.com/snyk/snyk-gradle-plugin/commit/bb1c1c72a75e97723a76b14d2d73f70744ed5009)
- [https://github.com/snyk/snyk-hex-plugin/commit/e8dd2a330b40d7fc0ab47e34413e80a0146d7ac3](https://github.com/snyk/snyk-hex-plugin/commit/e8dd2a330b40d7fc0ab47e34413e80a0146d7ac3)
- [https://github.com/snyk/snyk-mvn-plugin/commit/02cda9ba1ea36b00ead3f6ec2de0f97397ebec50](https://github.com/snyk/snyk-mvn-plugin/commit/02cda9ba1ea36b00ead3f6ec2de0f97397ebec50)

## Related threats

- [Snyk CLI insertion of sensitive information in log files in DEBUG mode](https://junglewise.ai/threats/cve-2025-6624-snyk-cli-insertion-of-sensitive-information-in-log-files-in-debug)
- [Snyk gradle plugin OS command injection](https://junglewise.ai/threats/cve-2024-48964-snyk-gradle-plugin-os-command-injection)
- [Snyk code injection via malicious build files](https://junglewise.ai/threats/cve-2022-24441-snyk-code-injection-via-malicious-build-files)
- [Snyk CLI command injection vulnerability](https://junglewise.ai/threats/cve-2022-40764-snyk-cli-command-injection-vulnerability)