CVE-2025-6624
📋 TL;DR
Snyk CLI versions before 1.1297.3 expose sensitive credentials in debug logs when running in DEBUG or TRACE mode. This affects users who run Snyk container, auth, or IaC commands with debug logging enabled and credentials provided via environment variables or command line arguments.
💻 Affected Systems
- Snyk CLI
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers with access to debug log files can steal container registry credentials, Snyk API tokens, and Docker registry tokens, potentially compromising container registries, Snyk accounts, and infrastructure.
Likely Case
Accidental credential exposure in debug logs stored on developer workstations or CI/CD systems, leading to credential leakage if logs are not properly secured.
If Mitigated
Minimal impact if debug logging is disabled or logs are properly secured with restricted access permissions.
🎯 Exploit Status
Exploitation requires access to debug log files containing the exposed credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1297.3
Vendor Advisory: https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607
Restart Required: No
Instructions:
1. Update Snyk CLI: npm update -g snyk 2. Verify version: snyk --version 3. Ensure version is 1.1297.3 or higher
🔧 Temporary Workarounds
Disable debug logging
allAvoid using DEBUG or TRACE logging modes when running Snyk commands with sensitive credentials.
unset SNYK_DEBUG
unset SNYK_LOG_LEVEL
Use credential files instead of environment variables
allStore credentials in secure files rather than passing via environment variables or command line.
🧯 If You Can't Patch
- Disable debug logging completely by removing DEBUG/TRACE environment variables
- Secure debug log files with strict file permissions (chmod 600) and regular cleanup
🔍 How to Verify
Check if Vulnerable:
Check Snyk CLI version: snyk --version. If version is below 1.1297.3, you are vulnerable when using debug logging with credentials.Check Version:
snyk --versionVerify Fix Applied:
Run snyk --version and confirm version is 1.1297.3 or higher. Test with debug logging enabled to verify credentials are no longer logged.📡 Detection & Monitoring
Log Indicators:
- Sensitive strings like passwords, tokens, or registry credentials in Snyk debug log files
- DEBUG or TRACE log entries containing credential patterns
Network Indicators:
- None - this is a local information disclosure issue
SIEM Query:
Search for log files containing 'SNYK_REGISTRY_PASSWORD', '--password', or token patterns in Snyk debug logs🔗 References
- https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli
- https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df
- https://github.com/snyk/cli/releases/tag/v1.1297.3
- https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18
- https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607
