-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snyk | npm | < 1.1297.3 | 1.1297.3 |
| github.com/snyk/go-application-framework | go | < 0.0.0-20250623124518-ca7ba7d72e68 |
Miggo AIRoot Cause AnalysisThe vulnerability is an insertion of sensitive information into log files when the Snyk CLI is run in debug mode. My analysis of the provided patches confirms this. The root cause is twofold: 1) several functions throughout the snyk/cli codebase were logging raw or insufficiently obfuscated command-line arguments, and 2) the underlying logging framework, snyk/go-application-framework, had an inadequate and non-deterministic scrubbing mechanism.
The patch in snyk/cli (38322f377da7e5f1391e1f641710be50989fa4df) addresses the first part by removing or altering the logging calls in functions like executeV1Default, legacycliWorkflow, args, and runWrapper that were identified as leaking the arguments.
The patch in snyk/go-application-framework (ca7ba7d72e68455afb466a7a47bb2c9aece86c18) addresses the second part by significantly enhancing the addMandatoryMasking function with more comprehensive regex patterns to detect various credential formats. It also fixes a critical flaw in the scrub function by sorting the redaction rules, ensuring they are applied deterministically.
Therefore, the vulnerable functions are both those that initiate the logging of sensitive data and the core scrubbing functions that failed to properly sanitize that data before it was written to the log file.