A command injection vulnerability in Snyk sweater-comb allows authenticated users to execute arbitrary OS commands, posing a high risk to system integrity.

This vulnerability is an OS command injection flaw (CWE-78) triggered when the expectGitBranch() function in src/lint.ts processes unsanitized input from the .vervet.yaml file. An attacker with low privileges who can control this configuration file can execute arbitrary commands on the underlying host when the linting process is executed.

Successful exploitation of this vulnerability allows an attacker to achieve arbitrary code execution on the host machine. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and the potential for lateral movement within the development environment.

Immediate Action: Update the Snyk sweater-comb package to version 3.8.8 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Monitor CI/CD pipeline logs for unexpected process execution or abnormal command-line arguments originating from the linting tool.

Compensating Controls: Restrict access to repository configuration files, such as .vervet.yaml, to trusted personnel to prevent unauthorized injection of malicious branch names.

Public Exploit Available: Unknown

The severity of this command injection vulnerability necessitates prompt action. Development teams using Snyk sweater-comb should verify their current version and apply the 3.8.8 update across all environments to eliminate the risk of arbitrary code execution.