CVE-2025-6624

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-6624
Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode. The issue affects the following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and --username/-u). 2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs. 3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 0.6 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli Technical Description
https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df Patch
https://github.com/snyk/cli/releases/tag/v1.1297.3 Release Notes
https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18 Patch
https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:snyk:snyk_cli:*:*:*:*:*:*:*:*
History

09 Jul 2025, 17:53

Type Values Removed Values Added
CPE cpe:2.3:a:snyk:snyk_cli:*:*:*:*:*:*:*:*
First Time Snyk
Snyk snyk Cli
References () https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli - () https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli - Technical Description
References () https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df - () https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df - Patch
References () https://github.com/snyk/cli/releases/tag/v1.1297.3 - () https://github.com/snyk/cli/releases/tag/v1.1297.3 - Release Notes
References () https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18 - () https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18 - Patch
References () https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607 - () https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607 - Third Party Advisory

26 Jun 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) Las versiones del paquete snyk anteriores a la 1.1297.3 son vulnerables a la inserción de información confidencial en el archivo de registro a través de los registros de depuración locales de la CLI de Snyk. Las credenciales del Registro de Contenedores proporcionadas mediante variables de entorno o argumentos de la línea de comandos pueden quedar expuestas al ejecutar la CLI de Snyk en modo DEBUG o DEBUG/TRACE. El problema afecta a los siguientes comandos de Snyk: 1. Al ejecutar los comandos snyk container test o snyk container monitor en un registro de contenedores con el modo de depuración habilitado, las credenciales del registro de contenedores pueden escribirse en el registro de depuración local de la CLI de Snyk. Esto solo ocurre con las credenciales especificadas en las variables de entorno (SNYK_REGISTRY_USERNAME y SNYK_REGISTRY_PASSWORD) o en la CLI (--password/-p y --username/-u). 2. Cuando se ejecuta el comando snyk auth con el modo de depuración habilitado y el nivel de registro establecido en TRACE, los tokens de credenciales de acceso/actualización de Snyk utilizados para conectar la CLI a Snyk pueden escribirse en los registros de depuración de la CLI local. 3. Cuando se ejecuta la prueba snyk iac con un paquete de reglas personalizadas de IAC remoto, con el modo de depuración habilitado y el nivel de registro establecido en TRACE, el token de registro de Docker puede escribirse en los registros de depuración de la CLI local.

26 Jun 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-26 05:15

Updated : 2025-07-09 17:53

NVD link : CVE-2025-6624

Mitre link : CVE-2025-6624

CVE.ORG link : CVE-2025-6624

JSON object : View

Products Affected

snyk

  • snyk_cli
CWE
CWE-532

Insertion of Sensitive Information into Log File