# CVE-2026-75486: Snyk Sweater Comb command injection in configuration parsing

Source: https://junglewise.ai/threats/cve-2026-75486-snyk-sweater-comb-command-injection-in-configuration-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75486 · Severity: high · CVSS 8 · Published 2026-08-28

Sweater Comb is a Node.js linting tool used to validate API specifications in development repositories. An attacker who crafts a malicious repository configuration file can execute arbitrary operating system commands when a developer or CI pipeline runs the linting tool against that repository, potentially exposing credentials, SSH keys, and sensitive source code.

Vendors: [Snyk](https://junglewise.ai/threats/vendors/snyk).

## Quick answers

**Is CVE-2026-75486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75486 being exploited in the wild.

**How severe is CVE-2026-75486?** High severity, with a CVSS score of 8, published 28 August 2026.

**Which products and versions are affected?** Snyk Sweater Comb before 3.8.8.

**Is there a fix for CVE-2026-75486?** A patch was published on 2026-08-27: Fix merged in PR #743 with commit 05a0eec Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75486 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-75486?** Check whether you run Snyk Sweater Comb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a command injection flaw in the expectGitBranch() function in src/lint.ts. The function passes an unsanitized branch name parameter directly into child_process.exec() via a template literal without escaping or validation. The branch name is sourced from the linters.<key>.optic-ci.original field in .vervet.yaml, which is fully attacker-controlled in a malicious repository. Since child_process.exec() invokes /bin/sh -c, shell metacharacters in the branch name are interpreted and executed. An attacker can inject commands by crafting a .vervet.yaml file with malicious payloads (e.g., "main; touch /tmp/canary") and committing it to a repository. When a developer or CI pipeline runs sweater-comb lint against that repository, the injected commands execute with the privileges of the user running the tool. The fix is to replace child_process.exec() with child_process.execFile() using an argument array to prevent shell interpretation.

## Affected products

- Snyk Sweater Comb before 3.8.8

## Timeline

- 2026-08-28: disclosed: CVE-2026-75486 published
- 2026-08-27: patched: Fix merged in PR #743 with commit 05a0eec

## References

- [https://github.com/snyk/sweater-comb/commit/05a0eec4f2acb9ce6d4814016b475504fc64eab2](https://github.com/snyk/sweater-comb/commit/05a0eec4f2acb9ce6d4814016b475504fc64eab2)
- [https://github.com/snyk/sweater-comb/pull/743](https://github.com/snyk/sweater-comb/pull/743)