TI-2022-19390 Aliases CVE-2022-40764 GHSA-hpqj-7cj6-hfj8

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins…

LOW 35CWE-78Published 2022-10-03 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957.

Why it matters now

EPSS 0.00612 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial snyk (npm): 1.996.0snyk-go-plugin (npm): 1.19.1Red Hat: 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	snyk (npm)	before 1.996.0	1.996.0	Patch available	GHSA-hpqj-7cj6-hfj8
—	snyk-go-plugin (npm)	before 1.19.1	1.19.1	Patch available	GHSA-hpqj-7cj6-hfj8

— Vendor— Affected all versions Fixed in — No fix listed CNA
snyk (npm) Vendor— Affected before 1.996.0 Fixed in 1.996.0 Patch available GHSA-hpqj-7cj6-hfj8
snyk-go-plugin (npm) Vendor— Affected before 1.19.1 Fixed in 1.19.1 Patch available GHSA-hpqj-7cj6-hfj8

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:snyk:cli::::::::	before 1.996.0	Vulnerable	Snyk
cpe:2.3:a:snyk:golang_cli::::::::	before 1.19.1	Vulnerable	Snyk

cpe:2.3:a:snyk:cli:*:*:*:*:*:*:*:* Versions before 1.996.0 Vulnerable ·Snyk
cpe:2.3:a:snyk:golang_cli:*:*:*:*:*:*:*:* Versions before 1.19.1 Vulnerable ·Snyk

Remediation

Fix · GHSA-hpqj-7cj6-hfj8 snyk (npm) Fixed in 1.996.0 Advisory →
Fix · GHSA-hpqj-7cj6-hfj8 snyk-go-plugin (npm) Fixed in 1.19.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Service Mesh 2	Affected	No fix planned: Will not fix
OpenShift Service Mesh 2.0	Affected	No fix planned: Will not fix
OpenShift Service Mesh 2.1	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2022-40764
2026-10-03 Alias added: GHSA-hpqj-7cj6-hfj8

References

Exploit 1

https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-40764

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences