Snyk vulnerabilities
We track 7 vulnerabilities in Snyk products across 10 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on August 28, 2026.
Latest Snyk vulnerabilities
- 8.0 High severity
sweater-comb: Improper Neutralization of Special Elements used in an OS Command
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch nam
- 7.2 High severity
snyk: Insertion of Sensitive Information into Log File
Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when e
- 8.1 High severity
Code Agent: Improper Control of Generation of Code
Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to execute arbitrary code within the Code Agent container. Exploiting this vulnerability would require an attacker to have netw
- 8.8 High severity
Snyk Cli: Improper Control of Generation of Code
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory na
- 9.8 Critical severity
Snyk Cli: Improper Neutralization of Special Elements used in an OS Command
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name.
- 8.8 High severity
snyk: Improper Neutralization of Special Elements used in an OS Command
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed
- 7.8 High severity
Cli: Improper Neutralization of Special Elements used in an OS Command
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstra