Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-6624

CVSS 7.2 · High EPSS 0.11% · P30
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-6624

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode. The issue affects the following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and --username/-u). 2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs. 3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过日志文件的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
Snyk CLI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Snyk CLI是美国Snyk公司的一个构建时工具，用于查找和修复项目中的已知漏洞。 Snyk CLI 1.1297.3之前版本存在安全漏洞，该漏洞源于敏感信息插入日志文件，可能导致凭据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-snyk 0 ~ 1.1297.3 -

II. Public POCs for CVE-2025-6624

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-6624

请登录查看更多情报信息。

Same Patch Batch · n/a · 2025-06-26 · 11 CVEs total

CVE-2024-529289.6 CRITICALArc 安全漏洞
CVE-2025-66937.8 HIGHRT-Thread device.c sys_device_write memory corruption
CVE-2025-49603Northern.tech Mender Server 安全漏洞
CVE-2025-30131IROAD Dashcam FX2 安全漏洞
CVE-2025-44141Backdrop CMS 安全漏洞
CVE-2025-293313x-ui 安全漏洞
CVE-2025-50350PHPGurukul Pre-School Enrollment System Project 安全漏洞
CVE-2025-51672PHPGurukul Dairy Farm Shop Management System 安全漏洞
CVE-2025-51671PHPGurukul Dairy Farm Shop Management System 安全漏洞
CVE-2024-56915Netbox 安全漏洞

IV. Related Vulnerabilities

Same product: snyk
Same vendor: n/a
Same weakness: CWE-532

V. Comments for CVE-2025-6624

No comments yet

Leave a comment