Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.

Snyk Sweater Comb versions before 3.8.8 contain a command injection vulnerability tracked as CVE-2026-75486. An attacker who controls the .vervet.yaml configuration file can execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The vulnerability exists in the expectGitBranch() function within src/lint.ts, which passes unsanitized branch names directly into child_process.exec() via an unescaped template literal. This allows arbitrary command execution when the lint command is run against a repository. The issue has been patched in version 3.8.8 of Snyk Sweater Comb. The fix is available via a GitHub commit and associated pull request. Users are advised to upgrade to v3.8.8 or later to mitigate the risk.