Snyk Sweater Comb vulnerabilities

1 vulnerability

Known vulnerabilities in Snyk Sweater Comb, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.5CVE-2026-75486snyksweater-comb
EPSS score
2.31%
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.