CVE-2026-75486: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in snyk sweater-comb

The vulnerability exists in snyk sweater-comb prior to version 3.8.8. An attacker with control over the .vervet.yaml configuration file can exploit improper neutralization of special elements in the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts uses the unsanitized branch name directly in a child_process.exec() call via an unescaped template literal, enabling arbitrary OS command execution when the lint command is run against the repository.

Successful exploitation allows an attacker with limited privileges (PR:L) and requiring user interaction (UI:A) to execute arbitrary OS commands with high impact on confidentiality, integrity, and availability of the affected system. This can lead to full system compromise or unauthorized actions on the host running the vulnerable software.

A fix is available in snyk sweater-comb version 3.8.8 and later. Users should upgrade to version 3.8.8 or newer to remediate this vulnerability. Since no official remediation level or patch link is provided, users should consult the vendor's advisory or release notes for the official patch. Until upgraded, avoid running lint commands on repositories with untrusted .vervet.yaml configuration files or untrusted branch names.