GitHub Advisoryadvisory · npm

GHSA-69f9-h8f9-7vjf OS Command Injection in Snyk php plugin

HIGH Published 2024-10-23 Modified 2024-10-23 Official page ↗
Aliases
CVE-2024-48963
Ecosystem
npm
Packages
snyk-php-plugin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2024-10-23

Affected packages

• npm snyk-php-plugin: < 1.10.0 → fixed in 1.10.0

Description

The Snyk php plugin is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.

Related

Alias · CVE (1)

  • CVE-2024-48963 The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References