HIGH7.5

GHSA-69f9-h8f9-7vjf

OS Command Injection in Snyk php plugin

Quick fix

GHSA-69f9-h8f9-7vjf — snyk-php-plugin: upgrade to the fixed version with the command below.

npm install snyk-php-plugin@1.10.0

Details

The Snyk php plugin is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/snyk-php-plugin

Introduced in: 0Fixed in: 1.10.0

Fixnpm install snyk-php-plugin@1.10.0

References

https://nvd.nist.gov/vuln/detail/CVE-2024-48963[ADVISORY]
https://github.com/snyk/snyk-php-plugin/commit/9189f093b94f9ce51672f6919ffbc98171fd66d4[WEB]
https://github.com/snyk/snyk-php-plugin[PACKAGE]
https://github.com/snyk/snyk-php-plugin/releases/tag/v1.10.0[WEB]