CVE-2026-75486 snyk CVE debrief

Who should care

Defenders responsible for Synk Sweater Comb installations, particularly those using versions before 3.8.8, should assess exposure and prioritize verification and remediation. This includes reviewing .vervet.yaml configuration files for potential malicious input, verifying and upgrading to version 3.8.8 or later, and monitoring for suspicious activity related to the linters.<key>.optic-ci.original branch name field. Additionally, defenders should consider  

Why it matters

CVE-2026-75486 is a command injection vulnerability in Synk Sweater Comb before version 3.8.8. Defenders should prioritize verifying and upgrading to version 3.8.8 or later, and review .vervet.yaml configuration files for potential malicious input.

• Potential arbitrary OS command execution
• Possible malicious input injection into .vervet.yaml configuration files
• Required verification of .vervet.yaml configuration files
• Necessary upgrade to version 3.8.8 or later

Technical summary

The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository. This vulnerability allows an attacker controlling the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The vulnerability is particularly concerning for defenders responsible for Synk Sweater Comb installations, especially those using versions before 3.8.8, as it could lead to potential arbitrary OS command execution and possible malicious input injection into .vervet.yaml

Defensive priority

Defenders should prioritize verifying and upgrading to version 3.8.8 or later, and review .vervet.yaml configuration files for potential malicious input.

Recommended defensive actions

• Verify and upgrade to version 3.8.8 or later
• Review .vervet.yaml configuration files for potential malicious input
• Monitor for suspicious activity related to the linters.<key>.optic-ci.original branch name field
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the corpus does not establish versions, exploitation, impact, or remediation beyond upgrading to version 3.8.8 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.