Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Name
Published Aug 28, 2026
8.5
HIGHCVSS 4.0
EPSS 2.31%
Description
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.
Affected products
-
Affected
- ≥ 0, < 3.8.8
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Snyk | Sweater-Comb | affected | Affected
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67789 Advisory
- https://github.com/snyk/sweater-comb/commit/05a0eec4f2acb9ce6d4814016b475504fc64eab2 patch
- https://github.com/snyk/sweater-comb/pull/743 exploitissue-trackingpatch
- https://github.com/snyk/sweater-comb/releases/tag/v3.8.8 release-notes
- https://www.vulncheck.com/advisories/synk-sweater-comb-command-injection-via-vervet-yaml-branch-name third-party-advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67789 | Advisory | |
| https://github.com/snyk/sweater-comb/commit/05a0eec4f2acb9ce6d4814016b475504fc64eab2 | patch | |
| https://github.com/snyk/sweater-comb/pull/743 | exploitissue-trackingpatch | |
| https://github.com/snyk/sweater-comb/releases/tag/v3.8.8 | release-notes | |
| https://www.vulncheck.com/advisories/synk-sweater-comb-command-injection-via-vervet-yaml-branch-name | third-party-advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data