CVE-2024-48963

What it actually does

The Snyk PHP plugin performs unsafe handling of the current working directory name during project scans, allowing arbitrary code to be injected and executed when snyk test is invoked inside an untrusted PHP project.

Why it matters to the business

Organizations relying on the plugin for dependency or code analysis risk arbitrary code execution on developer or CI systems when scanning untrusted projects, potentially leading to supply-chain compromise; prevalence in open-source ecosystems increases exposure for teams using the Git version of the plugin.

How an attack unfolds

An attacker crafts a PHP project directory whose name contains injectable code. When a victim runs the Snyk PHP plugin scan inside that directory, the plugin unsafely incorporates the directory name into command construction, resulting in code execution on the scanning host.

How to fix it

Upgrade snyk/snyk-php-plugin to commit d83c83a84052c53e9c481dcbc4875787d415f0eb or later. Restrict scans to trusted projects only. Apply the corresponding fixed kernel-livepatch package on SUSE systems where applicable.

How to confirm the fix worked

Confirm the installed plugin commit is d83c83a84052c53e9c481dcbc4875787d415f0eb or newer, then re-run scans against test projects containing crafted directory names to verify no code injection occurs.

Typical attack path

1. Attacker publishes or shares a malicious PHP project whose directory name embeds injectable commands
2. Victim clones or navigates into the project and executes snyk test
3. Plugin processes the current working directory and executes the injected commands
4. Attacker gains code execution within the context of the Snyk scan process

How to detect it

Review Snyk scan logs and process execution traces on developer workstations and CI runners for unexpected command invocations or child processes spawned during PHP project scans; correlate with directory names containing shell metacharacters.

What your security team should do

• Immediately upgrade the snyk-php-plugin to the fixed commit
• Enforce policy to scan only internally vetted or trusted projects
• Add pre-scan directory-name validation in CI pipelines
• Monitor EPSS and exploit maturity indicators for any future increase in risk