Sensitive Information Exposure in Snyk CLI Debug Logs

CVE-2025-6624

What is CVE-2025-6624?

Certain versions of Snyk CLI are vulnerable to the exposure of sensitive information through local debug logs. In DEBUG or TRACE mode, critical authentication credentials can be inadvertently recorded. This occurs during operations with specific Snyk commands such as snyk container test and snyk auth, where user credentials set in environment variables or command line arguments might be logged. Further, executing snyk iac test with custom rules and debug enabled could also expose sensitive tokens. Ensuring the latest version is used and minimizing debug mode for sensitive operations is essential to mitigate these risks.

References