CVE-2026-75486

Received Received - Intake

Synk Sweater Comb Command Injection via Config File

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-75486

EUVD

EUVD-2026-67789

Affected Vendors & Products

Vendor	Product	Version / Range
snyk	sweater_comb	to 3.8.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-75486 is a command injection vulnerability in Synk Sweater Comb versions before 3.8.8. It allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes unsanitized branch names directly into child_process.exec() via an unescaped template literal, enabling command execution when the lint command runs against a repository.

Detection Guidance

To detect this vulnerability, check the version of Synk Sweater Comb installed on your system. Run: npm list -g snyk-sweater-comb or npm list snyk-sweater-comb. If the version is below 3.8.8, the system is vulnerable. Additionally, inspect .vervet.yaml files in repositories for suspicious branch name entries under linters.<key>.optic-ci.original.

Impact Analysis

This vulnerability creates a supply-chain risk. If you run Synk Sweater Comb on a malicious repository, an attacker could execute arbitrary OS commands on your system. This could lead to exposure of credentials, SSH keys, source code, and other sensitive data. The impact is significant as it affects any developer or CI pipeline using vulnerable versions of the tool.

Mitigation Strategies

Immediately update Synk Sweater Comb to version 3.8.8 or later. Run: npm update -g snyk-sweater-comb or npm update snyk-sweater-comb. Avoid running sweater-comb lint on untrusted repositories. Review .vervet.yaml files in your repositories for malicious configurations.

Hi! I’m here to help you understand CVE-2026-75486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70