CVE-2026-75486: Snyk Sweater-Comb

High severity, CVSS 8.0. EPSS: 2.3% chance of exploitation in the next 30 days.

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.

Affected products

• Snyk Sweater-Comb: before 3.8.8 (fixed in 3.8.8)

Published 2026-08-28. Last modified 2026-09-08.