CVE-2026-75486

Synk Sweater Comb before 3.8.8 contains an OS command injection flaw (CWE-78) in the expectGitBranch() function of src/lint.ts, where an unsanitized branch name taken from the linters.<key>.optic-ci.original field of a repository's .vervet.yaml configuration file is interpolated into a child_process.exec() call through an unescaped template literal. An attacker who can control or modify that .vervet.yaml file can inject shell metacharacters into the branch name, and the injected commands execute when the lint command is run against the repository, which typically happens in a developer's shell or a CI pipeline. Successful exploitation yields arbitrary OS command execution with the privileges of the user or CI runner running lint, giving the attacker high-impact read/write access to that build environment, including any secrets exposed to the runner (CVSS v4.0 rates confidentiality, integrity, and availability impact as High). Only users running affected Sweater Comb versions against repositories whose .vervet.yaml can be controlled or modified by an attacker, such as through a pull request or untrusted contributor, are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 1.3% probability of exploitation in the next 30 days.

What to do: Upgrade Sweater Comb to 3.8.8 or later. Until then, restrict and review write access to .vervet.yaml (for example, require approval for pull requests that change that file), treat branch-name values in it as untrusted, and avoid running lint with credentials broader than necessary. Review CI and developer logs for unexpected command execution during lint runs.