Command Injection Affecting @snyk/sweater-comb package, versions >=2.0.3 <3.8.8
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-SNYKSWEATERCOMB-19477232
- published1 Sept 2026
- disclosed31 Aug 2026
- creditJashn Wahi
Introduced: 31 Aug 2026
NewCVE-2026-75486 (opens in a new tab)How to fix?
Upgrade @snyk/sweater-comb to version 3.8.8 or higher.
Overview
@snyk/sweater-comb is a “Sweats the small stuff, so you don’t have to. OpenAPI linting rules for Snyk APIs.”
Affected versions of this package are vulnerable to Command Injection through the expectGitBranch() function in src/lint.ts. An attacker can execute arbitrary OS commands by supplying a malicious branch name in the linters.<key>.optic-ci.original field of a .vervet.yaml file and then triggering the lint command against the repository. The vulnerable code passes that branch name directly into child_process.exec() inside an unescaped template literal, so the shell interprets injected metacharacters as part of the command. This can lead to full compromise of the system running the lint job, including arbitrary command execution with the privileges of that process.