High severity7.5NVD Advisory· Published Oct 23, 2024· Updated Jun 17, 2026

CVE-2024-48964

Description

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
snyk-gradle-pluginnpm	< 4.5.0	4.5.0

Affected products

osv-coords3 versions
pkg:apk/chainguard/snyk-cli pkg:apk/wolfi/snyk-cli pkg:npm/snyk-gradle-plugin
< 1.1294.0-r0+ 2 more
- (no CPE)range: < 1.1294.0-r0
- (no CPE)range: < 1.1294.0-r0
- (no CPE)range: < 4.5.0
Rich Harris/snykcpe-rescue
Range: 0
Snyk/Snyk Gradle Pluginv5
Range: 0

Patches

Vulnerability mechanics

References

github.com/snyk/snyk-gradle-plugin/commit/2f5ee7579f00660282dd161a0b79690f4a9c865dnvdPatchWEB
github.com/advisories/GHSA-qqqw-gm93-qf6mghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-48964ghsaADVISORY

News mentions

No linked articles in our index yet.

Severity

HighCVSS v3.1

7.5/ 10

CVSS v47.5

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: High
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected

Source repo: github.com/snyk/snyk-gradle-plugin

EPSS

Probability of exploitation in the next 30 days.

0.44%

VYPR risk score

Composite of severity, exploitation, and reach.

0.42medium

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

Weaknesses

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-94
Improper Control of Generation of Code ('Code Injection')

CVE ID

CVE-2024-48964