snyk Code Injection vulnerability
The package snyk before 1.1064.0 is vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable.
NOTE: This issue is independent of the one reported in CVE-2022-40764, and upgrading to a fixed version for this addresses that issue as well.
The affected IDE plugins and versions are:
- VS Code - Affected: <=1.8.0, Fixed: 1.9.0
- IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48
- Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31
- Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions
- Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | snyk | < 1.1064.0 | 1.1064.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-24441
- https://github.com/snyk/snyk-eclipse-plugin/commit/b5a8bce25a359ced75f83a729fc6b2393fc9a495
- https://github.com/snyk/snyk-intellij-plugin/commit/56682f4ba6081ce1d95cb980cbfacd3809a826f4
- https://github.com/snyk/snyk-ls/commit/b3229f0142f782871aa72d1a7dcf417546d568ed
- https://github.com/snyk/snyk-visual-studio-plugin/commit/0b53dbbd4a3153c3ef9aaf797af3b5caad0f731a
- https://github.com/snyk/vscode-extension/commit/0db3b4240be0db6a0a5c6d02c0d4231a2c4ba708
- https://security.snyk.io/vuln/SNYK-JS-SNYK-3111871
- https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-78, CWE-94- Platform
- npm
- Package
snyk- Disclosed
- 06.07.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4vrv-93c7-m92j - CC BY 4.0
Vulnerability history: snyk
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 10.2022 06.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 1
- Low 1
Disclosures per year
- 2022: 2
- 2023: 1
- 2024: 0
- 2025: 1
- 2026: 0
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.