CVE-2024-48963highCWE-78

CVE-2024-48963: high-severity vulnerability in Snyk Cli

Published · Updated

Follow this CVE+ Monitor Snyk Cli+ Monitor Snyk PHP Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.5%
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Snyk · Snyk CliSnyk · Snyk PHP Plugin
Related CVEs — Snyk Cli

In the same product, most dangerous first.

CVE-2024-48964HIGHCVE-2024-48964EPSS 0.5%