snyk@1.635.0 vulnerabilities
snyk library and cli utility
-
latest version
1.1293.1
-
latest non vulnerable version
-
first published
9 years ago
-
latest version published
25 days ago
-
licenses detected
- >=0.0.0-testing-patch <0.0.1; >=0.0.2-testing-patch <0.0.2; >=0.0.3-testing-patch <0.0.3; >=0.0.4-testing-patch <0.0.4; >=0.0.5-testing-patch <0.1.0; >=0.4.0
Direct Vulnerabilities
Known vulnerabilities in the snyk package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
snyk is an advanced tool that scans and monitors projects for security vulnerabilities. Affected versions of this package are vulnerable to Command Injection due to an incomplete fix for CVE-2022-40764. A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to exploit this vulnerability, a user would have to execute the This issue has been addressed in the latest Snyk Docker images available at https://hub.docker.com/r/snyk/snyk as of 2022-11-29. Images downloaded and built prior to that date should be updated. The issue has also been addressed in the Snyk TeamCity CI/CD plugin as of version v20221130.093605. How to fix Command Injection? Upgrade |
<1.1064.0
|
snyk is a advanced tool that scans and monitors projects for security vulnerabilities. Affected versions of this package are vulnerable to Code Injection.
when analyzing a project. An attacker who can convince a user to scan a malicious project can include
commands in a build file such as This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. NOTE: This issue is independent of the one reported in CVE-2022-40764, and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are:
How to fix Code Injection? Upgrade |
<1.1064.0
|
snyk is an advanced tool that scans and monitors projects for security vulnerabilities. Affected versions of this package are vulnerable to Command Injection via the A successful exploit, allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed. In order to exploit this vulnerability, a target would have to execute the “snyk test” command on untrusted files. As developers are unlikely to run "snyk test" on untrusted files, an attacker might have to trick them into opening a malicious file before running "snyk test". How to fix Command Injection? Upgrade |
<1.996.0
|