Homepage

@snyk/sweater-comb@3.8.3

“Sweats the small stuff, so you don’t have to. OpenAPI linting rules for Snyk APIs.”

  • latest version

    3.8.8

  • latest non vulnerable version

    3.8.8

  • first published

    5 years ago

  • latest version published

    7 days ago

  • licenses detected

  • View sweater-comb package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @snyk/sweater-comb package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Command Injection

    @snyk/sweater-comb is a “Sweats the small stuff, so you don’t have to. OpenAPI linting rules for Snyk APIs.”

    Affected versions of this package are vulnerable to Command Injection through the expectGitBranch() function in src/lint.ts. An attacker can execute arbitrary OS commands by supplying a malicious branch name in the linters.<key>.optic-ci.original field of a .vervet.yaml file and then triggering the lint command against the repository. The vulnerable code passes that branch name directly into child_process.exec() inside an unescaped template literal, so the shell interprets injected metacharacters as part of the command. This can lead to full compromise of the system running the lint job, including arbitrary command execution with the privileges of that process.

    How to fix Command Injection?

    Upgrade @snyk/sweater-comb to version 3.8.8 or higher.

    >=2.0.3 <3.8.8
    Go back to all versions of this package