CVE-2026-75486: Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Name
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into childprocess.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Synk Sweater Combto a version that resolves this vulnerability.Fixed in 3.8.8 - Configuration
Ensure the branch name provided in .vervet.yaml under <key>.optic-ci.original is sanitized/validated before it is consumed by Synk Sweater Comb; do not allow attacker-controlled unsanitized values to reach the lint execution path.
Synk Sweater Comb .vervet.yaml key: optic-ci.original branch name = Use a sanitized/validated branch name (ensure it cannot contain shell metacharacters) - Compensating control
Run lint only for repositories where .vervet.yaml is trusted/controlled by you, since an attacker controlling .vervet.yaml can inject commands into the linters.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Repositories using Synk Sweater Comb versions before 3.8.8 are exposed when an attacker can control or modify the repository's .vervet.yaml file and can cause the lint command to run against that repository.
What is required for exploitation?
The attacker needs control of the linters.<key>.optic-ci.original branch name value in .vervet.yaml. Exploitation occurs when the lint command runs, because the vulnerable code passes that value unsanitized to child_process.exec().
Does exploitation require user interaction?
Yes. The provided vector indicates user interaction is required, and the vulnerable path is reached when someone runs the lint command against the affected repository.
What should be done if immediate upgrading is not possible?
Restrict who can modify .vervet.yaml and do not run the lint command on repositories or changes containing untrusted configuration. Review linters.<key>.optic-ci.original values for shell metacharacters or other unexpected branch-name content.
How can teams determine whether they are affected?
Check whether Synk Sweater Comb is earlier than version 3.8.8 and whether .vervet.yaml uses linters.<key>.optic-ci.original branch-name settings. Repositories where untrusted parties can change that configuration are particularly at risk.