CVE-2026-75486: Synk Sweater Comb Command Injection RCE Flaw

CVE-2026-75486 Overview

CVE-2026-75486 is a command injection vulnerability [CWE-78] in Snyk Sweater Comb, an API linting tool, affecting all versions before 3.8.8. The flaw resides in the expectGitBranch() function in src/lint.ts, which passes an unsanitized branch name directly into child_process.exec() through an unescaped template literal. An attacker who controls the .vervet.yaml configuration file can inject shell metacharacters into the linters.<key>.optic-ci.original branch name field. When a developer or CI pipeline executes the lint command against the repository, arbitrary operating system commands run under the invoking user's context.

Critical Impact
Attackers who can commit or influence .vervet.yaml can achieve arbitrary code execution on developer workstations and CI/CD runners that execute Sweater Comb lint jobs.

Affected Products

Snyk Sweater Comb versions prior to 3.8.8
Repositories consuming Sweater Comb via .vervet.yaml with attacker-influenced branch name fields
CI/CD pipelines that invoke Sweater Comb lint against untrusted configurations

Discovery Timeline

2026-08-28 - CVE-2026-75486 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-75486

Vulnerability Analysis

Sweater Comb validates git branches referenced in .vervet.yaml by resolving them through git cat-file. The vulnerable implementation of expectGitBranch() built the shell command using a JavaScript template literal, embedding the branch name string without escaping or argument separation. Because child_process.exec() spawns /bin/sh -c, any shell metacharacters within the branch value are interpreted by the shell rather than treated as literal argument data.

Exploitation requires an attacker to control the .vervet.yaml file, which is a realistic threat in pull-request workflows, forked repository contributions, and supply-chain scenarios where configuration files are pulled from untrusted sources. Command execution occurs with the privileges of the process running the linter, typically the developer account or a CI/CD service account with repository and secret access.

Root Cause

The root cause is unsafe concatenation of untrusted input into a shell command string. Sweater Comb treated the original branch name field as trusted configuration data, but the value flows into a shell invocation without sanitization, allowlisting, or use of an argument-array API.

Attack Vector

An attacker submits or commits a .vervet.yaml file containing a crafted branch name such as main; <command> under linters.<key>.optic-ci.original. When Sweater Comb runs git cat-file -t <branchName>, the shell executes the injected command. In CI/CD, this can lead to secret exfiltration, source code tampering, or lateral movement into build infrastructure.

typescript

// Patch in src/lint.ts (commit 05a0eec4f2acb9ce6d4814016b475504fc64eab2)
 const expectGitBranch = (branchName: string) => {
   return new Promise((resolve, reject) => {
-    child_process.exec(
-      `git cat-file -t ${branchName}`,
+    if (branchName.startsWith("-")) {
+      reject(new Error(`invalid git ref: ${branchName}`));
+      return;
+    }
+    child_process.execFile(
+      "git",
+      ["cat-file", "-t", branchName],
       (err, stdout, stderr) => {
         if (err) {
           reject(new Error(stderr));

The fix replaces child_process.exec() with child_process.execFile(), which invokes git directly without a shell, and rejects branch names beginning with - to prevent argument-flag injection. Source: GitHub Commit 05a0eec.

Detection Methods for CVE-2026-75486

Indicators of Compromise

.vervet.yaml files containing branch names with shell metacharacters such as ;, |, `, $(, &&, or leading - under linters.<key>.optic-ci.original.
Unexpected child processes spawned by node or the Sweater Comb CLI during lint execution, particularly shells, curl, wget, or network utilities.
Outbound network connections from CI/CD runners to unknown destinations during linting stages.

Detection Strategies

Statically scan repository configuration files for suspicious values in the optic-ci.original field before running the linter.
Monitor process lineage on developer machines and CI runners for sh -c invocations descending from the sweater-comb or vervet process trees.
Inspect CI job logs for git cat-file executions preceded or followed by unrelated command output.

Monitoring Recommendations

Alert on execution of Sweater Comb versions below 3.8.8 in build pipelines using software inventory data.
Correlate lint-stage process telemetry with egress network events to detect data exfiltration attempts.
Track modifications to .vervet.yaml in pull requests and flag changes to branch name fields for security review.

How to Mitigate CVE-2026-75486

Immediate Actions Required

Upgrade Snyk Sweater Comb to version 3.8.8 or later across all developer workstations and CI/CD environments.
Audit repositories for .vervet.yaml files and validate that branch name fields contain only expected ref values.
Rotate credentials and tokens accessible to any CI/CD runner that executed Sweater Comb against untrusted configurations.

Patch Information

The fix is available in GitHub Release v3.8.8 and was merged via Pull Request #743. Refer to the VulnCheck Advisory for Sweater Comb for full advisory details.

Workarounds

Pin Sweater Comb to 3.8.8 or newer in package.json and lock files, and block older versions in your registry proxy.
Restrict who can modify .vervet.yaml using CODEOWNERS and require security review for changes to lint configuration files.
Execute lint jobs in ephemeral, least-privilege containers without access to production secrets or long-lived credentials.

bash

# Upgrade Sweater Comb to the patched release
npm install --save-dev @useoptic/sweater-comb@^3.8.8

# Verify the installed version
npx sweater-comb --version