CVE-2026-75486

HighCVSS 8.0/10Last modified Sep 8, 2026

Description

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-75497.3A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?acti CVE-2026-754967.2Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible CVE-2026-754977.2Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges CVE-2026-754987.2Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges CVE-2026-75507.3A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.CVE-2026-755056.0EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission c CVE-2026-755077.5GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMe CVE-2026-755087.5GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limi CVE-2026-755096.5joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version CVE-2026-75518.8HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configu CVE-2026-755105.1Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react CVE-2026-755115.3Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber cr