GHSA-6hwc-9h8r-3vmf — low GitHub Advisory (CVE-2025-6624) in npm/snyk

Description

Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode.

The issue affects the following Snyk commands:

When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and --username/-u).
When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs.
When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.

Basic information

Type: reviewed
Severity: low
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2025-06-26 06:31:04 UTC
Updated: 2025-06-30 11:42:50 UTC
GitHub reviewed: 2025-06-30 11:42:49 UTC
NVD published: 2025-06-26

Score	Percentile
0.03%	9.59%

CVSS Scores

Base score	Version	Severity	Vector
7.3	3.1	—	`CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.
1.2	4.0	—	`CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:P` Click to expand Attack vector (AV:L) Attacker needs local access on the target system. Attack complexity (AC:H) Exploitation depends on constrained or hard-to-reproduce conditions. Attack requirements (AT:P) Additional preconditions must be present for exploitation. Privileges required (PR:H) High privileges are required. User interaction (UI:P) A user has to participate (for example click/open/approve). Vulnerable system confidentiality impact (VC:L) Limited confidentiality impact on the vulnerable system. Vulnerable system integrity impact (VI:N) No integrity impact on the vulnerable system. Vulnerable system availability impact (VA:N) No availability impact on the vulnerable system. Subsequent system confidentiality impact (SC:H) High confidentiality impact on subsequent systems. Subsequent system integrity impact (SI:H) High integrity impact on subsequent systems. Subsequent system availability impact (SA:H) High availability impact on subsequent systems. Exploit maturity (threat) (E:P) Proof-of-concept: public PoC exists; no reported exploitation and no known simplification tools.

Identifiers

Type	Value
GHSA	GHSA-6hwc-9h8r-3vmf ↗
CVE	CVE-2025-6624 ↗

CWEs

CWE id	Name
CWE-532	Insertion of Sensitive Information into Log File

Affected packages (2)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
npm	snyk	< 1.1297.3	1.1297.3	—
go	github.com/snyk/go-application-framework	< 0.0.0-20250623124518-ca7ba7d72e68	—	—

Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode