Skip to main content

Insertion of Sensitive Information into Log File

CVE-2025-6624

Low
2.4/10

Summary

Versions of the package snyk through 1.1297.2 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in 'DEBUG' or 'DEBUG/TRACE' mode. The issue affects the following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables ('SNYK_REGISTRY_USERNAME' and 'SNYK_REGISTRY_PASSWORD'), or in the CLI (--password/-p and --username/-u). 2. When snyk auth command is executed with debug mode enabled AND the log level is set to 'TRACE', the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs. 3. When snyk 'iac' test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to 'TRACE', the docker registry token may be written into the local CLI debug logs. The go module "github.com/snyk/go-application-framework" is also affected prior to pseudo-version v0.0.0-20250623124518-ca7ba7d72e68.

  • HIGH
  • LOCAL
  • HIGH
  • CHANGED
  • REQUIRED
  • HIGH
  • HIGH
  • HIGH

CWE-532 - Insertion of Sensitive Information into Log File

It's quite common for applications to save logs. For example, whenever a user requests a resource from a particular website, the web server writes information about the request to a log file. These files are helpful for identifying abnormal system activity, bugs, and evaluating the security controls of the application. Security of log files is critical for the overall security of the application and its confidential resources. An application that lacks appropriate logging levels can expose sensitive user data and system information stored on the log files to malicious users. This info can be exploited to compromise your system.

References

Advisory Timeline

  • Published