TI-2022-07159 Aliases CVE-2022-22984 GHSA-4x6g-3cmx-w76r

Command injection in snyk

MEDIUM 61CWE-78Published 2022-11-30 · Updated 2025-04-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin before 5.6.5; the package @snyk/snyk-hex-plugin before 1.1.6 are vulnerable to Command Injection due to an incomplete fix for [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342). A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to exploit this vulnerability, a user would have to execute the snyk test command on untrusted files. In most cases, an attacker positioned to control the command line arguments to the Snyk CLI would already be positioned to execute arbitrary commands. However, this could be abused in specific scenarios, such as continuous integration pipelines, where developers can control the arguments passed to the Snyk CLI to leverage this component as part of a wider attack against an integration/build pipeline. This issue has been addressed in the latest Snyk Docker images available at https://hub.docker.com/r/snyk/snyk as of 2022-11-29. Images downloaded and built prior to that date should be updated. The issue has also been addressed in the Snyk TeamCity CI/CD plugin as of version v20221130.093605.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.03225 88th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial snyk: 1.1064.0snyk-mvn-plugin: 2.31.3+14 more productsRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	snyk	before 1.1064.0	1.1064.0	Patch available	CNA
—	snyk-mvn-plugin	before 2.31.3	2.31.3	Patch available	CNA
—	snyk-gradle-plugin	before 3.24.5	3.24.5	Patch available	CNA
—	@snyk/snyk-cocoapods-plugin	before 2.5.3	2.5.3	Patch available	CNA
—	snyk-sbt-plugin	before 2.16.2	2.16.2	Patch available	CNA
—	snyk-python-plugin	before 1.24.2	1.24.2	Patch available	CNA
—	snyk-docker-plugin	before 5.6.5	5.6.5	Patch available	CNA
—	@snyk/snyk-hex-plugin	before 1.1.6	1.1.6	Patch available	CNA
—	snyk (npm)	before 1.1064.0	1.1064.0	Patch available	GHSA-4x6g-3cmx-w76r
—	snyk-mvn-plugin (npm)	before 2.31.3	2.31.3	Patch available	GHSA-4x6g-3cmx-w76r
—	snyk-sbt-plugin (npm)	before 2.16.2	2.16.2	Patch available	GHSA-4x6g-3cmx-w76r
—	snyk-python-plugin (npm)	before 1.24.2	1.24.2	Patch available	GHSA-4x6g-3cmx-w76r
—	@snyk/snyk-hex-plugin (npm)	before 1.1.6	1.1.6	Patch available	GHSA-4x6g-3cmx-w76r
—	snyk-gradle-plugin (npm)	before 3.24.5	3.24.5	Patch available	GHSA-4x6g-3cmx-w76r
—	snyk-docker-plugin (npm)	before 5.6.5	5.6.5	Patch available	GHSA-4x6g-3cmx-w76r
—	@snyk/snyk-cocoapods-plugin (npm)	before 2.5.3	2.5.3	Patch available	GHSA-4x6g-3cmx-w76r

snyk Vendor— Affected before 1.1064.0 Fixed in 1.1064.0 Patch available CNA
snyk-mvn-plugin Vendor— Affected before 2.31.3 Fixed in 2.31.3 Patch available CNA
snyk-gradle-plugin Vendor— Affected before 3.24.5 Fixed in 3.24.5 Patch available CNA
@snyk/snyk-cocoapods-plugin Vendor— Affected before 2.5.3 Fixed in 2.5.3 Patch available CNA
snyk-sbt-plugin Vendor— Affected before 2.16.2 Fixed in 2.16.2 Patch available CNA
snyk-python-plugin Vendor— Affected before 1.24.2 Fixed in 1.24.2 Patch available CNA
snyk-docker-plugin Vendor— Affected before 5.6.5 Fixed in 5.6.5 Patch available CNA
@snyk/snyk-hex-plugin Vendor— Affected before 1.1.6 Fixed in 1.1.6 Patch available CNA
snyk (npm) Vendor— Affected before 1.1064.0 Fixed in 1.1064.0 Patch available GHSA-4x6g-3cmx-w76r
snyk-mvn-plugin (npm) Vendor— Affected before 2.31.3 Fixed in 2.31.3 Patch available GHSA-4x6g-3cmx-w76r
snyk-sbt-plugin (npm) Vendor— Affected before 2.16.2 Fixed in 2.16.2 Patch available GHSA-4x6g-3cmx-w76r
snyk-python-plugin (npm) Vendor— Affected before 1.24.2 Fixed in 1.24.2 Patch available GHSA-4x6g-3cmx-w76r
@snyk/snyk-hex-plugin (npm) Vendor— Affected before 1.1.6 Fixed in 1.1.6 Patch available GHSA-4x6g-3cmx-w76r
snyk-gradle-plugin (npm) Vendor— Affected before 3.24.5 Fixed in 3.24.5 Patch available GHSA-4x6g-3cmx-w76r
snyk-docker-plugin (npm) Vendor— Affected before 5.6.5 Fixed in 5.6.5 Patch available GHSA-4x6g-3cmx-w76r
@snyk/snyk-cocoapods-plugin (npm) Vendor— Affected before 2.5.3 Fixed in 2.5.3 Patch available GHSA-4x6g-3cmx-w76r

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:a:snyk:snyk_cli::::::::	before 1.1064.0	Vulnerable	Snyk
cpe:2.3:a:snyk:snyk_cocoapods_cli::::::snyk::*	before 2.5.3	Vulnerable	Snyk
cpe:2.3:a:snyk:snyk_docker_cli::::::snyk::*	before 5.6.5	Vulnerable	Snyk
cpe:2.3:a:snyk:snyk_gradle_cli::::::snyk::*	before 3.24.5	Vulnerable	Snyk
cpe:2.3:a:snyk:snyk_hex_cli::::::snyk::*	before 1.1.6	Vulnerable	Snyk
cpe:2.3:a:snyk:snyk_maven_cli::::::snyk::*	before 2.31.3	Vulnerable	Snyk
cpe:2.3:a:snyk:snyk_python_cli::::::snyk::*	before 1.24.2	Vulnerable	Snyk
cpe:2.3:a:snyk:snyk_sbt_cli::::::snyk::*	before 2.16.2	Vulnerable	Snyk

cpe:2.3:a:snyk:snyk_cli:*:*:*:*:*:*:*:* Versions before 1.1064.0 Vulnerable ·Snyk
cpe:2.3:a:snyk:snyk_cocoapods_cli:*:*:*:*:*:snyk:*:* Versions before 2.5.3 Vulnerable ·Snyk
cpe:2.3:a:snyk:snyk_docker_cli:*:*:*:*:*:snyk:*:* Versions before 5.6.5 Vulnerable ·Snyk
cpe:2.3:a:snyk:snyk_gradle_cli:*:*:*:*:*:snyk:*:* Versions before 3.24.5 Vulnerable ·Snyk
cpe:2.3:a:snyk:snyk_hex_cli:*:*:*:*:*:snyk:*:* Versions before 1.1.6 Vulnerable ·Snyk
cpe:2.3:a:snyk:snyk_maven_cli:*:*:*:*:*:snyk:*:* Versions before 2.31.3 Vulnerable ·Snyk
cpe:2.3:a:snyk:snyk_python_cli:*:*:*:*:*:snyk:*:* Versions before 1.24.2 Vulnerable ·Snyk
cpe:2.3:a:snyk:snyk_sbt_cli:*:*:*:*:*:snyk:*:* Versions before 2.16.2 Vulnerable ·Snyk

Remediation

Fix · CNA snyk Fixed in 1.1064.0
Fix · CNA snyk-mvn-plugin Fixed in 2.31.3
Fix · CNA snyk-gradle-plugin Fixed in 3.24.5
Fix · CNA @snyk/snyk-cocoapods-plugin Fixed in 2.5.3
Fix · CNA snyk-sbt-plugin Fixed in 2.16.2
Fix · CNA snyk-python-plugin Fixed in 1.24.2
Fix · CNA snyk-docker-plugin Fixed in 5.6.5
Fix · CNA @snyk/snyk-hex-plugin Fixed in 1.1.6
Fix · GHSA-4x6g-3cmx-w76r snyk (npm) Fixed in 1.1064.0 Advisory →
Fix · GHSA-4x6g-3cmx-w76r snyk-mvn-plugin (npm) Fixed in 2.31.3 Advisory →
Fix · GHSA-4x6g-3cmx-w76r snyk-sbt-plugin (npm) Fixed in 2.16.2 Advisory →
Fix · GHSA-4x6g-3cmx-w76r snyk-python-plugin (npm) Fixed in 1.24.2 Advisory →
Fix · GHSA-4x6g-3cmx-w76r @snyk/snyk-hex-plugin (npm) Fixed in 1.1.6 Advisory →
Fix · GHSA-4x6g-3cmx-w76r snyk-gradle-plugin (npm) Fixed in 3.24.5 Advisory →
Fix · GHSA-4x6g-3cmx-w76r snyk-docker-plugin (npm) Fixed in 5.6.5 Advisory →
Fix · GHSA-4x6g-3cmx-w76r @snyk/snyk-cocoapods-plugin (npm) Fixed in 2.5.3 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-11-30
snyk 1.1064.0
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-08313 Code injection in snykPriority LOW 39
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Service Mesh 2	Affected	No fix planned: Will not fix
OpenShift Service Mesh 2.1	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2022-22984
2026-10-03 Alias added: GHSA-4x6g-3cmx-w76r

References

Exploit 1

https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/

Patch 8

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-22984

Other 1

https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution

TI-2022-08313 Code injection in snyk CVSS 3.1HIGH 8.8
TI-2024-32649 OS command injection in Snyk Cli CVSS 4.0HIGH 7.5
TI-2024-32648 OS command injection in Snyk Cli CVSS 4.0HIGH 7.5
TI-2025-06016 Sensitive information in log files in snyk CVSS 4.0LOW 2.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences