CVE-2022-40764: OS Command Injection
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/snyk-go-pluginto a version that resolves this vulnerability.Fixed in 1.19.1 - Upgrade
Upgrade
npm/snykto a version that resolves this vulnerability.Fixed in 1.996.0 - Upgrade
Upgrade
snyk-clito a version that resolves this vulnerability.Fixed in 1.996.0 - Upgrade
Upgrade
snyk-go-pluginto a version that resolves this vulnerability.Fixed in 1.19.1 - Upgrade
Upgrade
Snyk TeamCity pluginto a version that resolves this vulnerability.Fixed in 20220930.142957
Event History
Frequently Asked Questions
What is CVE-2022-40764?
CVE-2022-40764 is a vulnerability that allows arbitrary command execution in Snyk CLI before version 1.996.0.
How does CVE-2022-40764 affect Snyk IDE plugins?
CVE-2022-40764 affects Snyk IDE plugins by allowing arbitrary command execution.
How does CVE-2022-40764 affect the Snyk npm package?
CVE-2022-40764 affects the Snyk npm package by allowing arbitrary command execution.
How can CVE-2022-40764 be exploited?
CVE-2022-40764 can be exploited by viewing untrusted files in the Visual Studio Code editor.
What is the severity of CVE-2022-40764?
CVE-2022-40764 has a severity rating of 7.8 (high).
How can I fix CVE-2022-40764?
To fix CVE-2022-40764, update Snyk CLI to version 1.996.0 or higher and Snyk IDE plugins to version 1.19.1 or higher.