Synk Sweater Comb releases before 3.8.8 contain a vulnerability that allows a user with control over the .vervet.yaml configuration file to inject and execute arbitrary operating system commands. The flaw arises when the expectGitBranch() function in src/lint.ts uses an unsanitized branch name directly in an unescaped template literal passed to child_process.exec(). When a linter command is run, the malicious input in the linters.<key>.optic-ci.original branch name field is executed, giving the attacker full command‑execution privileges on the host where the linting process runs. This weakness is categorized as CWE‑78. Affected systems are projects that use any pre‑3.8.8 version of the Snyk Sweater Comb tool. According to the CNA product list, the vulnerability applies to the snyk:sweater‑comb package. The impacted releases are all versions earlier than 3.8.8; no specific sub‑version range is listed beyond the general cutoff.

Affected systems are projects that use any pre-3.8.8 version of the Snyk Sweater Comb tool. According to the CNA product list, the vulnerability applies to the snyk:sweater‑comb package. The impacted releases are all versions earlier than 3.8.8; no specific sub‑version range is listed beyond the general cutoff.

Risk and exploitability assessment indicates a CVSS score of 8.5, denoting high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting limited known exploitation. Nonetheless, the attack vector requires controlled modification of the .vervet.yaml file and execution of the lint command, which may be possible for contributors with write access to repository configuration. The lack of input validation in expectGitBranch() directly leads to the ability to run arbitrary commands on behalf of the process executing the lint check.