Command Injection Vulnerability in Snyk Sweater Comb Product

CVE-2026-75486

What is CVE-2026-75486?

The Snyk Sweater Comb product before version 3.8.8 contains a command injection vulnerability, allowing attackers to inject malicious input via the .vervet.yaml configuration file. By manipulating the linters..optic-ci.original branch name field, an attacker can execute arbitrary operating system commands. This flaw arises from the expectGitBranch() function in src/lint.ts, which passes an unsanitized branch name directly into child_process.exec() using an unescaped template literal. When the lint command is executed against the repository, it can lead to severe security risks.

References