GHSA-4vrv-93c7-m92j

Suggest an improvement
Source
https://github.com/advisories/GHSA-4vrv-93c7-m92j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-4vrv-93c7-m92j/GHSA-4vrv-93c7-m92j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4vrv-93c7-m92j
Aliases
Published
2023-07-06T19:24:04Z
Modified
2025-04-24T21:40:56Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
snyk Code Injection vulnerability
Details

The package snyk before 1.1064.0 is vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable.

NOTE: This issue is independent of the one reported in CVE-2022-40764, and upgrading to a fixed version for this addresses that issue as well.

The affected IDE plugins and versions are:

  • VS Code - Affected: <=1.8.0, Fixed: 1.9.0
  • IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48
  • Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31
  • Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions
  • Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Database specific 
{
    "cwe_ids": [
        "CWE-78",
        "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T21:36:19Z",
    "nvd_published_at": "2022-11-30T13:15:00Z",
    "severity": "HIGH"
}
References

Affected packages

npm / snyk

Package

Name
snyk
View open source insights on deps.dev
Purl
pkg:npm/snyk

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.1064.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-4vrv-93c7-m92j/GHSA-4vrv-93c7-m92j.json"