Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-6624

Quick assessment

Affected
n/a snyk
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Snyk CLI是美国Snyk公司的一个构建时工具，用于查找和修复项目中的已知漏洞。 Snyk CLI 1.1297.3之前版本存在安全漏洞，该漏洞源于敏感信息插入日志文件，可能导致凭据泄露。

CVSS 7.2 · High EPSS 0.15% · P5
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-6624

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode. The issue affects the following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and --username/-u). 2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs. 3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Snyk CLI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Snyk CLI是美国Snyk公司的一个构建时工具，用于查找和修复项目中的已知漏洞。 Snyk CLI 1.1297.3之前版本存在安全漏洞，该漏洞源于敏感信息插入日志文件，可能导致凭据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- snyk 0 ~ 1.1297.3 -

II. Public POCs for CVE-2025-6624

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 5840 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2025-6624

请登录查看更多情报信息。

Same Patch Batch · n/a · 2025-06-26 · 11 CVEs total

CVE-2024-52928 9.6 CRITICAL Arc 安全漏洞
CVE-2025-6693 7.8 HIGH RT-Thread device.c sys_device_write memory corruption
CVE-2025-49603 Northern.tech Mender Server 安全漏洞
CVE-2025-30131 IROAD Dashcam FX2 安全漏洞
CVE-2025-44141 Backdrop CMS 安全漏洞
CVE-2025-29331 3x-ui 安全漏洞
CVE-2025-50350 PHPGurukul Pre-School Enrollment System Project 安全漏洞
CVE-2025-51672 PHPGurukul Dairy Farm Shop Management System 安全漏洞
CVE-2025-51671 PHPGurukul Dairy Farm Shop Management System 安全漏洞
CVE-2024-56915 Netbox 安全漏洞

IV. Related Vulnerabilities

Same product: snyk
Same vendor: n/a
Same weakness: CWE-532

V. Comments for CVE-2025-6624

No comments yet

Leave a comment