Executive brief
Snyk CLI is a security scanning tool that developers use to scan code for vulnerabilities. A command injection flaw allowed attackers to execute arbitrary system commands when users opened untrusted files in an editor, potentially compromising developer machines and the code they manage. This could lead to data theft, malware installation, or supply chain attacks.
Technical details
A command injection vulnerability (CWE-78) in Snyk CLI before version 1.996.0 allowed arbitrary command execution through shell metacharacters in untrusted configuration files (e.g., vendor.json ignore field). The vulnerability was inherited by IDE plugins and the snyk npm package, and also affected snyk-go-plugin before 1.19.1. Attack vectors include viewing untrusted project files in editors like Visual Studio Code, where the Snyk integration would parse malicious input. No special privileges or user interaction beyond opening a file is required. The vulnerability was patched in snyk v1.996.0 and snyk-go-plugin v1.19.1.
Affected products
- Snyk CLI before 1.996.0
- Snyk snyk-go-plugin before 1.19.1
- Snyk TeamCity plugin before 20220930.142957
Timeline
- 2022-10-04: disclosed
- 2022-10-04: patched: Snyk CLI v1.996.0 released