CVE-2024-48964
CVE-2024-48964
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.
CVSS 7.5 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
snyk cli
- Versions
- ≥ 0, < 1.1294.0: Affected (semver)
Update to 1.1294.0
snyk gradle plugin
- Versions
- ≥ 0, < 4.5.0: Affected (semver)
Update to 4.5.0
snyk-gradle-plugin npm
- Affected ranges
- SEMVER: < 4.5.0
Update to 4.5.0