CyberRota Analysis
AI-GeneratedThe vulnerability allows attackers with control over the .vervet.yaml configuration file to execute arbitrary operating system commands by injecting malicious input into the branch name field. This can lead to unauthorized access and manipulation of the system when the lint command is executed. Organizations using Synk Sweater Comb versions prior to 3.8.8 should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.