npm/@snyk/snyk-hex-plugin CVE-2022-22984: medium 6.3, EPSS 3.12%
Snyk plugins vulnerable to Command Injection
Action: Upgrade @snyk/snyk-hex-plugin to 1.1.6 or later.
npm i @snyk/snyk-hex-plugin@1.1.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.6 | - |
Fixed versions
| 1.1.6 |
Sources
- osv: GHSA-4x6g-3cmx-w76r#npm/@snyk/snyk-hex-plugin
- https://nvd.nist.gov/vuln/detail/CVE-2022-22984
- https://github.com/snyk/cli/commit/80d97a93326406e09776156daf72e3caa03ae25a
- https://github.com/snyk/snyk-cocoapods-plugin/commit/c73e049c5200772babde61c40aab57296bf91381
- https://github.com/snyk/snyk-docker-plugin/commit/d730d7630691a61587b120bb11daaaf4b58a8357
- https://github.com/snyk/snyk-gradle-plugin/commit/bb1c1c72a75e97723a76b14d2d73f70744ed5009
- https://github.com/snyk/snyk-hex-plugin/commit/e8dd2a330b40d7fc0ab47e34413e80a0146d7ac3
- https://github.com/snyk/snyk-mvn-plugin/commit/02cda9ba1ea36b00ead3f6ec2de0f97397ebec50
- https://github.com/snyk/snyk-python-plugin/commit/8591abdd9236108ac3e30c70c09238d6bb6aabf4
- https://github.com/snyk/snyk-sbt-plugin/commit/99c09eb12c9f8f2b237aea9627aab1ae3cab6437
- https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution
- https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKHEXPLUGIN-3039680
- https://security.snyk.io/vuln/SNYK-JS-SNYKSNYKCOCOAPODSPLUGIN-3038625
- https://security.snyk.io/vuln/SNYK-JS-SNYKSBTPLUGIN-3038626
- https://security.snyk.io/vuln/SNYK-JS-SNYKPYTHONPLUGIN-3039677
- https://security.snyk.io/vuln/SNYK-JS-SNYKMVNPLUGIN-3038623
- https://security.snyk.io/vuln/SNYK-JS-SNYKGRADLEPLUGIN-3038624
- https://security.snyk.io/vuln/SNYK-JS-SNYKDOCKERPLUGIN-3039679
- https://security.snyk.io/vuln/SNYK-JS-SNYK-3038622
CVE-2022-22984 · published · modified · JSON