Is CVE-2022-40764 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-40764 being exploited in the wild.

How severe is CVE-2022-40764?

Low severity, with a CVSS score of 3.1, published 4 October 2022.

Which products and versions are affected?

snyk (npm) SEMVER:introduced=0,fixed=1.996.0; snyk-go-plugin (npm) SEMVER:introduced=0,fixed=1.19.1; Snyk TeamCity plugin before 20220930.142957.

Is there a fix for CVE-2022-40764?

Yes. snyk (npm): upgrade to 1.996.0 or later; snyk-go-plugin (npm): upgrade to 1.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-40764 attacked?

It is attacked with local access.

Am I affected by CVE-2022-40764?

Check whether you run snyk (npm), snyk-go-plugin (npm) or Snyk TeamCity plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-40764: Snyk CLI command injection vulnerability

CVE-2022-40764 · Severity: low · CVSS 3.1 · Published 2022-10-04

Snyk CLI is a security scanning tool that developers use to scan code for vulnerabilities. A command injection flaw allowed attackers to execute arbitrary system commands when users opened untrusted files in an editor, potentially compromising developer machines and the code they manage. This could lead to data theft, malware installation, or supply chain attacks.

Technologies: snyk (npm). Vendors: npm, Snyk.

Quick answers

Is CVE-2022-40764 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-40764 being exploited in the wild.
How severe is CVE-2022-40764?: Low severity, with a CVSS score of 3.1, published 4 October 2022.
Which products and versions are affected?: snyk (npm) SEMVER:introduced=0,fixed=1.996.0; snyk-go-plugin (npm) SEMVER:introduced=0,fixed=1.19.1; Snyk TeamCity plugin before 20220930.142957.
Is there a fix for CVE-2022-40764?: Yes. snyk (npm): upgrade to 1.996.0 or later; snyk-go-plugin (npm): upgrade to 1.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-40764 attacked?: It is attacked with local access.
Am I affected by CVE-2022-40764?: Check whether you run snyk (npm), snyk-go-plugin (npm) or Snyk TeamCity plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snyk (npm): upgrade to 1.996.0 or later
```
npm install snyk@1.996.0
```
snyk-go-plugin (npm): upgrade to 1.19.1 or later
```
npm install snyk-go-plugin@1.19.1
```

Technical details

A command injection vulnerability (CWE-78) in Snyk CLI before version 1.996.0 allowed arbitrary command execution through shell metacharacters in untrusted configuration files (e.g., vendor.json ignore field). The vulnerability was inherited by IDE plugins and the snyk npm package, and also affected snyk-go-plugin before 1.19.1. Attack vectors include viewing untrusted project files in editors like Visual Studio Code, where the Snyk integration would parse malicious input. No special privileges or user interaction beyond opening a file is required. The vulnerability was patched in snyk v1.996.0 and snyk-go-plugin v1.19.1.

Affected products

Snyk CLI before 1.996.0
Snyk snyk-go-plugin before 1.19.1
Snyk TeamCity plugin before 20220930.142957

Identifiers

CVE-2022-40764
GHSA-hpqj-7cj6-hfj8

Timeline

2022-10-04: disclosed
2022-10-04: patched: Snyk CLI v1.996.0 released

References

https://github.com/snyk/cli

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.