GitHub Advisoryadvisory · npm

GHSA-qqqw-gm93-qf6m OS Command Injection in Snyk gradle plugin

HIGH Published 2024-10-23 Modified 2024-10-23 Official page ↗
Aliases
CVE-2024-48964
Ecosystem
npm
Packages
snyk-gradle-plugin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-78, CWE-94
Reviewed
2024-10-23

Affected packages

• npm snyk-gradle-plugin: < 4.5.0 → fixed in 4.5.0

Description

The Snyk gradle plugin is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.

Related

Alias · CVE (1)

  • CVE-2024-48964 The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. vulnerability

Weakness · CWE (2)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
  • CWE-94 Improper Control of Generation of Code weakness

References