Published: 03/10/2022 Updated: 08/08/2023

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 0

Snyk CLI prior to 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin prior to 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) prior to 20220930.142957.

Vulnerable Product	Search on Vulmon	Subscribe to Product
snyk cli
snyk golang cli

Description The MITRE CVE dictionary describes this issue as: Snyk CLI before 19960 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example The original demonstration was with shell me ...

CWE-78 https://github.com/snyk/snyk-go-plugin/releases/tag/v1.19.1 https://github.com/snyk/cli/releases/tag/v1.996.0 https://support.snyk.io/hc/en-us/articles/7015908293789-CVE-2022-40764-Command-Injection-vulnerability-affecting-Snyk-CLI-versions-prior-to-1-996-0 https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2022-40764

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-40764

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect