CVE-2025-6624: Snyk Snyk CLI Insertion Of Sensitive Vulnerability

LOW
Advisory Identifier: GHSA-6hwc-9h8r-3vmf
Share
CVSS 7.2
CWE-532
Published
Advisory Summary

CVE-2025-6624 is a LOW (CVSS 7.2) snyk cli insertion of sensitive vulnerability (CWE-532: Insertion of Sensitive Information into Log File) affecting Snyk libraries in the npm ecosystem. The issue involves snyk cli insertion of sensitive information into log file allowed in debug or debug/trace mode. Remediation is available by upgrading affected packages to version 1.1297.3.

CVE-2025-6624 at a Glance

CVE Identifier CVE-2025-6624
GHSA Identifier GHSA-6hwc-9h8r-3vmf
Severity LOW
CVSS v3.1 Base Score 7.2
CWE Classification CWE-532: Insertion of Sensitive Information into Log File
Affected Product Snyk
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 7.2

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity High (AC:H)
Privileges Required High (PR:H)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2025-6624

To remediate this vulnerability, upgrade all affected Snyk dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

snyk fixed: 1.1297.3 
npm install snyk@1.1297.3
github.com/snyk/go-application-framework fixed: Latest secure release 
Upgrade github.com/snyk/go-application-framework to Latest secure release
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls snyk

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2025-6624, inspect your project dependencies using npm:

npm ls snyk

Analyze the terminal output to locate any version of Snyk in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.1297.3), your application is affected.

Note: The npm ls snyk command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-532: Insertion of Sensitive Information into Log File, where the product writes sensitive information to a log file. In Snyk, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode. The issue affects the following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and --username/-u). 2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs. 3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.

CVE-2025-6624 Affected Snyk Versions

2 component(s)
Fixed Versions:
1.1297.3
Product / Package Ecosystem Affected Versions Fixed Version
snyk
npm/snyk
npm
< 1.1297.3
1.1297.3
github.com/snyk/go-application-framework
golang/github.com/snyk/go-application-framework
Go

References

NVD — CVE-2025-6624 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6624
Security Fix Commit FIX COMMIT
https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df
Security Fix Commit FIX COMMIT
https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18
Snyk Security Information SECURITY
https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli
Snyk Source Repository REPOSITORY
https://github.com/snyk
Snyk Release RELEASE
https://github.com/snyk/cli/releases/tag/v1.1297.3
Snyk Security Information SECURITY
https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607

Frequently Asked Questions

What is CVE-2025-6624?
CVE-2025-6624 is a security vulnerability in Snyk involving Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode under CWE-532: Insertion of Sensitive Information into Log File.
Which Snyk versions are affected?
Affected versions include releases prior to 1.1297.3 across affected packages: snyk, github.com/snyk/go-application-framework.
What version fixes CVE-2025-6624?
Upgrading to 1.1297.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is snyk affected?
Yes, snyk is affected in releases prior to 1.1297.3. Upgrade your dependency to 1.1297.3 or later.
Is github.com/snyk/go-application-framework affected?
Yes, github.com/snyk/go-application-framework is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What is the CVSS score of CVE-2025-6624?
CVE-2025-6624 has a CVSS v3.1 base score of 7.2 (LOW) with vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H.
What CWE is associated with CVE-2025-6624?
CVE-2025-6624 is classified under CWE-532: Insertion of Sensitive Information into Log File (The product writes sensitive information to a log file.).
How can I check npm dependencies for CVE-2025-6624?
Run the dependency tree command: 'npm ls snyk'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6hwc-9h8r-3vmf",
  "modified" : "2025-06-30T11:42:49Z",
  "published" : "2025-06-26T06:31:04Z",
  "aliases" : [ "CVE-2025-6624" ],
  "summary" : "Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode",
  "details" : "Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode.\n\nThe issue affects the following Snyk commands:\n\n1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and  --username/-u).\n\n2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs.\n\n3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "snyk"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.1297.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/snyk/go-application-framework"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "< 0.0.0-20250623124518-ca7ba7d72e68"
    }
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-6624"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snyk/cli/commit/38322f377da7e5f1391e1f641710be50989fa4df"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18"
  }, {
    "type" : "WEB",
    "url" : "https://docs.snyk.io/snyk-cli/debugging-the-snyk-cli"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snyk"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snyk/cli/releases/tag/v1.1297.3"
  }, {
    "type" : "WEB",
    "url" : "https://security.snyk.io/vuln/SNYK-JS-SNYK-10497607"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-532" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-06-30T11:42:49Z",
    "nvd_published_at" : "2025-06-26T05:15:23Z"
  }
}