Snyk CLI Before 1.1294.0 Vulnerable to Code Injection
CVE-2024-48964

8.8HIGH

Key Information:

Vendor

Snyk

Status
Snyk Cli
Snyk Gradle Plugin
Vendor
CVE Published:
23 October 2024

What is CVE-2024-48964?

The Snyk CLI package prior to version 1.1294.0 contains a vulnerability that allows for code injection when scanning untrusted Gradle projects. This issue stems from improper handling of the current working directory name during the test process. As a result, malicious entities could potentially exploit this vulnerability by running Snyk tests in environments that have not been verified to be safe. Snyk advises users to restrict testing to trusted projects to mitigate the risks associated with this vulnerability.

Affected Version(s)

Snyk Cli 0 < 1.1294.0

Snyk Gradle Plugin 0 < 4.5.0

References

https://github.com/snyk/snyk-gradle-plugin/commit/2f5ee75...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.