Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snyk-php-plugin | npm | < 1.10.0 | 1.10.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper command execution patterns in the Snyk PHP plugin. The commit diff shows critical changes in lib/composer-cmds.ts where command execution was refactored to pass commands and arguments separately via spawnSync. Previously, commands like pharCmd were constructed as concatenated strings (e.g., php ${path.resolve(...)} ...) and executed as single strings. When combined with the current working directory name (untrusted user input), this allowed command injection via shell metacharacters in directory names. The functions execWithResult and cmdReturnsOk were directly responsible for executing these unsafe command strings without proper argument sanitization or separation, making them the root cause of the OS command injection vulnerability.
