CVE-2025-6624: Low severity Snyk Snyk CLI vulnerability
Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode.
The issue affects the following Snyk commands:
1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYKREGISTRYUSERNAME and SNYKREGISTRYPASSWORD), or in the CLI (--password/-p and --username/-u).
2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs.
3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/snykto a version that resolves this vulnerability.Fixed in 1.1297.3 - Upgrade
Upgrade
snykto a version that resolves this vulnerability.Fixed in 1.1297.3 - Configuration
Do not run Snyk CLI with DEBUG or DEBUG/TRACE mode enabled when using registry credentials via environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD) or CLI flags (--password/-p and --username/-u).
Snyk CLI debug logging DEBUG/TRACE mode and TRACE log level = disable - Compensating control
If you must run affected Snyk commands in debug mode, ensure the TRACE log level is not enabled, so that Snyk access/refresh credential tokens and container registry credentials are not written to local Snyk CLI debug logs (applies to snyk auth with debug+TRACE, and to container test/monitor with debug enabled).
- Operational
After any execution where Snyk CLI debug/TRACE logs may have captured sensitive registry credentials or Snyk access/refresh tokens, rotate the exposed container registry credentials and any potentially exposed Snyk tokens.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6624?
CVE-2025-6624 is classified as a high-severity vulnerability due to the potential exposure of sensitive container registry credentials.
How do I fix CVE-2025-6624?
To fix CVE-2025-6624, upgrade to Snyk CLI version 1.1297.3 or later.
What information is exposed due to CVE-2025-6624?
CVE-2025-6624 can expose sensitive container registry credentials that are provided through environment variables or command line arguments.
In which versions of Snyk CLI is CVE-2025-6624 present?
CVE-2025-6624 affects Snyk CLI versions prior to 1.1297.3.
How does CVE-2025-6624 allow for sensitive information exposure?
CVE-2025-6624 allows sensitive information exposure through local Snyk CLI debug logs when run in DEBUG mode.