Skip to main content
Filter by
Sorted by
Tagged with
-1 votes
0 answers
66 views

Snyk vulnerability for sending unsanitized HTML from Nodejs server

I have a route in node.js express server, which hits to a remote html document and returns the content of remote html document as 'text/html' in response. Snyk complains this saying: "Unsanitized ...
Dev_spidey's user avatar
1 vote
1 answer
94 views

Failed to download or update Snyk dependencies. "code":"UNABLE_TO_GET_ISSUER_CERT_LOCALLY",

I am trying to install snyk extension on VScode. i am getting this error message in output window of VSCode [Error] Failed to download or update Snyk dependencies. {"code":"...
Kajal Bhandare's user avatar
0 votes
2 answers
95 views

Snyk denial of service: utp:[email protected] > io.grpc:[email protected] > io.netty:[email protected]

I've encountered a vulnerability after running the Snyk open source security management tool and am not sure how to resolve it. I believe this is related to a library pulled in by the Android Gradle ...
VIN's user avatar
  • 6,856
0 votes
0 answers
220 views

How can I fix "CVE-2023-42364 busybox/busybox Use After Free" vulnerability in node:alpine for Next.js application?

I have the following Dockerfile for my Next.js application: FROM node:alpine AS base # 2) Install dependencies only when needed. FROM base AS deps # 3) Install packages with no cache RUN apk add --...
Europa's user avatar
  • 1,112
0 votes
0 answers
34 views

Implementing a Scheduled Code Scan on AWS CodeCommit with Snyk

I am currently using AWS CodeCommit for my version control system and Snyk for scanning my codebase for vulnerabilities. I am interested in setting up a weekly scheduled scan of my codebase with Snyk. ...
Yiffany's user avatar
  • 347
0 votes
1 answer
287 views

Unsanitized input from an HTTP parameter flows into django.http.HttpResponse

In my python (django) project, I have following code snippet someError = request.GET.get('error', None) if someError is not None: self.logger.exception(f'Authorization failed ...
Karan's user avatar
  • 844
1 vote
0 answers
174 views

Snyk test fails when executed via Jenkins

We are getting the following error when running the Jenkins job to test our React Native code base for vulnerabilities. Snyk installation is UP-TO-DATE Testing for known issues... > /Users/...
Ishan Hettiarachchi's user avatar
0 votes
0 answers
651 views

Invalid OCI archive error for snyk/actions/docker@master

I am trying to implement the following workflow for my image which was built successfully: # Step 1: Build a Docker image - name: Build a Docker image run: docker build --no-cache -f ./Dockerfile --...
merilstack's user avatar
0 votes
0 answers
85 views

Login with AJAX and Open Redirect Vulnerability

I have a ASP.NET Core 8 MVC project where user login is an AJAX request that if successfull redirects user to "home" (or another internal page). This situation made SNYK trigger an "...
rd1218's user avatar
  • 371
-1 votes
1 answer
126 views

How to pass gradle project properties for snyk test of gradle project

In case we pass environment variable for values of a gradle's project property say in build.gradle say, we use: url "https://${nexusDomain}/repository/gvhvid-maven-public" then running snyk ...
Harsha G V's user avatar
1 vote
1 answer
668 views

Snyk doesn't check vulnerabilities in main code files

I added my github projects to snyk.io portal to check vulnerabilities. Sadly, snyk is only checking files ending with the .json, .yml, .txt etc. It's not checking vulnerabilities in typescript, js, ...
Damika's user avatar
  • 772
0 votes
2 answers
350 views

How do I configure my .snyk file to fail the build automatically if the setting to ignore a particular vulnerability has passed its expiry?

I have a .snyk policy file which is supposed to ignore vulnerabilities until a given date: version: v1.25.0 ignore: <REDACTED>: - '*': reason: >- This ...
Mick McCarthy's user avatar
0 votes
1 answer
697 views

Snyk report medium severity for license

after running pipeline on a java project I get some vulnerability related to license but I do not get what is the issue. Below the report: EPL-1.0 license Dual license: EPL-1.0, LGPL-2.1 What is ...
StefanoSKAL's user avatar
1 vote
0 answers
29 views

`snyk-scm-contributor-count` failing to retrieve project list from github

I am trying to retrieve a contributor count using Snyk's snyk-scm-contributor-count to count the list of contributors. However when I run this: snyk-scm-contributor-count github-enterprise --token ...
Lex Caldwell's user avatar
1 vote
0 answers
362 views

AntiForgeryToken suggested by SNYK tool

I'm solving some issues shown at SNYK tool (https://snyk.io/). I've got this issue: Anti-forgery token validation disabled. This ASP.NET MVC action should use an anti-forgery validation attribute. ...
rd1218's user avatar
  • 371
0 votes
1 answer
105 views

Snyk reporting vulnerabilities in Apache-Beam 2.52.0

We have Snyk integrated with our Python repository to identify any vulnerabilities in any of the libraries we are using. I am trying to add the dependency of apache-beam 2.52.0 (latest version) to ...
Sumit Desai's user avatar
  • 1,730
2 votes
1 answer
2k views

org.yaml.snakeyaml.representer.Representer: method <init>()V not found in mvn java

I am getting this error after updating my pom dependency. from snakeyaml 1.3 >>>>> snakeyaml 2.0 and spring-boot to 2.7.10 Error org.springframework.beans.factory....
Welcome_back's user avatar
  • 1,405
0 votes
0 answers
93 views

Jenkins Snyk plugin issue, artifacts are not found

I have a jenkins pipeline. I am using Snyk security plugin I have the following code the following step to build and create a report file and publish it as artefact stage('Snyk Scan') { steps ...
Mansingh Chauhan's user avatar
0 votes
1 answer
73 views

Audit of all user-initiated activity within a Snyk org/group

Task: Perform audit of all user-initiated activity within a Snyk org/group Steps that I followed: I referred this document: https://docs.snyk.io/snyk-admin/manage-users-in-organizations-and-groups/...
Harsha G V's user avatar
1 vote
1 answer
916 views

NPM Installing dependency I do not want and it is a vulnerability, how can I remove it?

I am currently seeing a vulnerability reporting on my docker image for a package I do not want. The package is found here: https://snyk.io/advisor/npm-package/monorepo-symlink-test In my node_modules ...
user68288's user avatar
  • 744
1 vote
1 answer
290 views

npm - a package's 6th level dependency is shown to be using outdated version by snyk

In my node.js project, I have dependency on packageA. Since this package is archived now, I had to override one of it's dependencies (not sure if this is relevant). My package.json looks like this- ......
John Reese's user avatar
3 votes
1 answer
905 views

How to run multiple Snyk commands in a GitHub Actions workflow?

I'm setting up a GitHub Actions workflow to perform security scans on my Node.js project using Snyk. I want to run multiple Snyk commands within the same job of the workflow, but I'm not sure how to ...
Sujeet's user avatar
  • 3,760
1 vote
1 answer
184 views

How to address CWE-502 for Swift's Codable

Snyk.io has alerted me to a CWE-502 issue with a Swift class that implements Codable. Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without ...
Scott McKenzie's user avatar
1 vote
1 answer
319 views

'snyk-scm-contributors-count' is not recognized as an internal or external command, operable program or batch file

I have Synk CLI installed on my local and yet snyk-scm-contributors-count is not found. I haven't found the correct documentation for it. Trying to see if anyone else having similar issues.
Sai Teja Makani's user avatar
3 votes
1 answer
1k views

Can snyk be configured to ignore all issues for a particular maven dependency?

I would like to clarify some moments regarding snyk ignore. Is it possible to configure .snyk file to ignore all kinds of issues for a particular maven dependency. https://docs.snyk.io/snyk-cli/...
John Smith's user avatar
3 votes
3 answers
2k views

How to sanitize api response server side?

I have an Express Request Handler that takes a request, which includes user form input (email), makes a request to another one of my (trusted) endpoints (via newFunctionWithRequest), and then returns ...
grabury's user avatar
  • 5,417
1 vote
1 answer
250 views

Snyk issue status in API - ignore, open, resolve

Is there any way in Snyk to run an API query for getting the status of a specific issue (ignored, open, resolved, etc.)?
Jonathan Gruber's user avatar
2 votes
1 answer
339 views

Does Snyk offer management for Open Source License Compliance? If yes, is it possible to generate reports based on the licences being used?

Does Snyk offer management for Open Source License Compliance? If yes, is it possible to generate reports based on the licences being used? I was wondering if Snyk is able to offer any management and ...
Miklos Csecsi's user avatar
4 votes
0 answers
218 views

Retrieving Snyk's vulnerability alerts in Splunk

How could one retrieve Snyk's vulnerabilities into Splunk? I am thinking the Splunk OpenTelemetry Collector could be a good integration point, but willing to know if someone has a parser before ...
Jonathan Gruber's user avatar
2 votes
1 answer
354 views

Automatically open Jira ticket for issues in Snyk

I would like to be able to open tickets automatically from Snyk to Jira for new issues found. Based on new or existing vulnerabilities. And I would like to be able to create Jira tickets for issues ...
Jonathan Gruber's user avatar
1 vote
1 answer
133 views

Snyk SCA (Software Composition Analysis) and continuous monitoring

Does Snyk support doing SCA + continuous monitoring of the findings when configuring an SCM integration? How would it work and what are the different steps to configure to get regular scans as we ...
Wesley Bentura's user avatar
2 votes
1 answer
502 views

Snyk and Automatic Pull request

Does Snyk send PRs automatically when integrating from the SCM (Github, Gitlab...) ? I tried the Fix PR with Snyk and that worked - now I'd like to automate the PR
Wesley Bentura's user avatar
2 votes
1 answer
84 views

What is the breaking change criteria with Snyk

What is the criteria for choosing what upgrade involves a breaking change at Snyk when it comes to the Fix pull/merge request. For example, Pillow v8.1.2 to v9.2.0 I tried to upgrade the pillow ...
Wesley Bentura's user avatar
4 votes
1 answer
688 views

How can Snyk push notifications to MS Teams?

Snyk has native integrations to Slack, ServiceNow, Jira and others But no integration to MS Teams How can a team get Snyk notifications pushed to MS Teams?
Jonathan Gruber's user avatar
0 votes
1 answer
966 views

How to solve ReDOS pointed out by snyk

I'm new to frontend programming. I'm charged to check vulnerabilities on an app. I'm using Snyk which point out this portion of code as code security vulnerability: const re = new RegExp('(' + query....
Zik 3r's user avatar
  • 1
2 votes
1 answer
2k views

How do we ignore folders in Snyk

How can I ignore/exclude folders or directories when scanning a project at Snyk, whether in CLI or in SCM scan? It seems that an import of a Snyk Code or Snyk Open Source project don't behave in the ...
Jonathan Gruber's user avatar
1 vote
0 answers
130 views

NTIA minimum SBOM requirement tool

I am trying to generate SBOM for Java, Python, ios(Swift) and Android (kotlin) project. I need to follow the NTIA guidelines for minimum element for SBOM (https://www.ntia.doc.gov/files/ntia/...
bostonjava's user avatar
0 votes
2 answers
174 views

How to stay on top of OWASP dependencycheck reports

We are using OWASP dependency check. It's a great tool, but it reports lots of vulnerabilities. A big proportion of them is false positives. We can suppress them using the suppression file, but with ...
Lukas's user avatar
  • 14.1k
4 votes
1 answer
464 views

How can I plug Snyk vulnerability scans into JIRA so I get automatically created tickets when new vulns are discovered?

I'd like to configure my Snyk organization so that newly discovered vulnerabilities automatically generate a new ticket in Jira that I can assign to someone on my team to remediate. Any idea how I can ...
rdegges's user avatar
  • 33.7k
1 vote
1 answer
324 views

Snyk Suggests higher version of dependent starters than the spring boot version

We are using Snyk for vulnerability checks in our build pipelines. The spring boot version that is being used in the project is 2.6.6 and the versions of all other dependencies are hence inherited. ...
mukut bhattacharjee's user avatar
0 votes
0 answers
142 views

Issue running Snyk test against a fresh firebase project

I am trying to get started with Snyk on my existing Firebase project and running into this error when trying snyk test: Dependency firebase-admin was not found in package-lock.json. Your package.json ...
GeneRator's user avatar
0 votes
2 answers
245 views

Snyk disabling an automatic test

I'm totally surprised but I looks like it's not possible to disable Snyk automatic tests. In my case Snyk integrated with bitbucket. Snyk analyze code each time new commit is merged. I want to test ...
RedBluff's user avatar
5 votes
1 answer
781 views

Is it possible to solve org.jetbrains.kotlin:kotlin-stdlib vulnerability from OkHttp?

I'm using Snyk service to check my projects for vulnerabilities. Projects with OkHttp dependency have one common vulnerability: Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib Introduced through:...
Yevhen Vasyliev's user avatar
1 vote
1 answer
3k views

Ignore snyk code quality issue with .snyk file

Snyk finds some code quality issue that should be ignored. I'm using Snyk CLI: "snyk code test" ✗ [High] Server-Side Request Forgery (SSRF) Path: project/src/main/java/com/MyClass.java, ...
Nickname0222022022's user avatar
0 votes
1 answer
768 views

Ignore all instances of certain software license

I have a .snyk file with a number of entries like these: 'snyk:lic:maven:org.clojure:tools.analyzer.jvm:EPL-1.0': - '*': reason: 'ignore license issue' expires: '2100-01-15T00:00:...
Brett Rowberry's user avatar
1 vote
2 answers
682 views

Snyk CLI for docker scan azure pipeline

I need to run snyk scan for Azure container and set it to fail only when there are new vulnerabilities found as compared to previous image. I did follow the snyk-delta document to configure task in ...
Vaybhaw's user avatar
  • 11
0 votes
1 answer
513 views

How can I add a snyk badge to my private repository?

I want to add badges to a the readme file showing the green or red badges for the vulnerabilities detected by snyk. I am using snyk and have integrated it with my GitHub account. Accroding to the snyk ...
Jayanta Basumatary's user avatar
1 vote
1 answer
395 views

Snyk server can be installed in a machine without internet?

I have been using sonarqube and now i want to use snyk but dont know if it is possible to install it in an machine locally and without internet access. Snyk server can be install in an local machine ...
Wonser's user avatar
  • 11
3 votes
1 answer
2k views

Snyk vulnerability scan not recognizing overriden nested package dependencies

I am running the snyk test command on my project to identify vulnerabilities with third party libraries and came across the following vulnerabilities in [email protected] ->@svgr/webpack": &...
svs's user avatar
  • 63
0 votes
1 answer
294 views

Snyk finds vulnaribilities in Simple Injector

In our .NET 6 apis we are using Simple Injector for dependency injection. With the latest version of Simple Injector, we observed that Snyk found five high-priority vulnerabilities and two medium ...
Thomas Limburg's user avatar