CVE-2025-6624: Snyk CLI Information Disclosure Vulnerability

CVE-2025-6624 Overview

CVE-2025-6624 is an information disclosure vulnerability in the Snyk command-line interface (CLI) that writes sensitive credentials into local debug log files. Versions of the snyk package prior to 1.1297.3 insert container registry credentials, Snyk access tokens, refresh tokens, and Docker registry tokens into debug logs when the CLI runs with debug or trace logging enabled. The flaw is tracked as CWE-532: Insertion of Sensitive Information into Log File. Exploitation requires local access to the debug log files produced by an affected CLI invocation.

Critical Impact
Container registry credentials, Snyk authentication tokens, and Docker registry tokens can be exposed to any local actor who reads the debug log files.

Affected Products

Snyk CLI (snyk) versions prior to 1.1297.3
Snyk go-application-framework versions prior to commit ca7ba7d72e68
Any CI/CD or developer environment executing Snyk CLI commands with DEBUG or DEBUG/TRACE logging enabled

Discovery Timeline

2025-06-26 - CVE-2025-6624 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6624

Vulnerability Analysis

The Snyk CLI writes runtime state, environment variable values, and command invocation data into local debug logs when the user enables verbose logging. The credential sanitization routine failed to redact several credential types before they were serialized to disk. The vulnerability affects three command paths.

First, snyk container test and snyk container monitor executed with debug mode write container registry credentials into the debug log when credentials are supplied through SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD environment variables or through the --username/-u and --password/-p command-line flags.

Second, snyk auth executed with debug mode and log level TRACE writes the Snyk access token and refresh token used to authenticate the CLI to the Snyk backend.

Third, snyk iac test executed against a remote infrastructure-as-code custom rules bundle with debug mode and TRACE logging writes the Docker registry token to the debug log.

Root Cause

The credential sanitization logic in the go-application-framework package did not cover analytics and instrumentation code paths that emit request and response metadata. Credentials passed through environment variables and CLI flags reached logging sinks before sanitization. The upstream fix imports a dedicated logging package into pkg/analytics/analytics.go and pkg/analytics/instrumentation_collector.go to redact sensitive values consistently.

Attack Vector

An attacker with local read access to the debug log files, such as another user on a shared build agent, a container escape, or a compromised backup, can extract the credentials and reuse them to authenticate against the container registry, the Snyk API, or the Docker registry. The attack requires that a legitimate user first execute an affected Snyk CLI command with debug or trace logging enabled.

// Security patch applied to pkg/analytics/analytics.go
// Source: https://github.com/snyk/go-application-framework/commit/ca7ba7d72e68455afb466a7a47bb2c9aece86c18
import (
	"bytes"
	"github.com/snyk/go-application-framework/pkg/logging"

	//nolint:gosec // insecure sha1 used for legacy identifier
	"crypto/sha1"
	"encoding/json"
)

The patch imports the logging package into the analytics and instrumentation collectors so credential-bearing fields pass through the sanitizer before being emitted.

Detection Methods for CVE-2025-6624

Indicators of Compromise

Snyk CLI debug log files (typically written under the user profile or working directory) containing strings that match container registry usernames, passwords, or bearer tokens
Presence of SNYK_REGISTRY_USERNAME, SNYK_REGISTRY_PASSWORD, --password, or -p values in plain text within snyk debug output
Access token or refresh token patterns appearing near snyk auth invocations in log archives

Detection Strategies

Scan CI/CD build artifacts, agent workspaces, and log aggregation systems for Snyk debug log fragments that contain credential patterns
Audit shell history and pipeline definitions for snyk container, snyk auth, or snyk iac test invocations that use --debug, -d, or LOG_LEVEL=trace
Correlate CLI version metadata in logs against the fixed version 1.1297.3 to identify hosts still running affected releases

Monitoring Recommendations

Alert on read access to Snyk debug log files by accounts other than the invoking developer or service account
Monitor Snyk API and container registry authentication events for tokens that were previously captured in debug logs and rotate credentials on any match
Track deployment of the Snyk CLI package across developer endpoints and build agents to confirm patch coverage

How to Mitigate CVE-2025-6624

Immediate Actions Required

Upgrade the Snyk CLI to version 1.1297.3 or later on every developer workstation, build agent, and container image that ships the CLI
Rotate any container registry credentials, Snyk access tokens, Snyk refresh tokens, and Docker registry tokens that may have been used with affected CLI versions under debug or trace logging
Delete existing Snyk CLI debug log files from local systems, backups, and centralized log stores

Patch Information

Snyk released the fix in Snyk CLI v1.1297.3. The CLI update pulls in the fixed go-application-framework at commit ca7ba7d72e68, which improves credential sanitization in the analytics and instrumentation logging paths. See the Snyk CLI commit 38322f3 for the dependency bump and the Snyk advisory SNYK-JS-SNYK-10497607 for vendor guidance.

Workarounds

Disable debug and trace logging for Snyk CLI invocations in production and CI/CD pipelines until the patched version is deployed. Refer to the Snyk CLI Debugging Guide for logging configuration
Restrict filesystem permissions on directories where the Snyk CLI writes debug output so only the invoking user can read the files
Prefer short-lived credentials and scoped registry tokens so that any exposure in historical debug logs has limited residual value

bash

# Upgrade Snyk CLI to the patched version and verify
npm install -g snyk@1.1297.3
snyk --version

# Remove existing debug logs that may contain credentials
rm -f ./snyk-debug.log ~/.config/configstore/snyk-debug.log

# Avoid enabling debug/trace in production pipelines
# Do NOT set: snyk container test --debug -u "$USER" -p "$PASS"
snyk container test my/image:tag