CVE-2020-7653

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-29 · updated 2026-06-17
Weakness: CWE-59

Description

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.

Affected products

snyk-broker: before 4.80.0 — fixed in 4.80.0

How to fix

Upgrade to a fixed version: snyk-broker 4.80.0. Check the vendor advisory for mitigations.

References

https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570612
https://updates.snyk.io/snyk-broker-security-fixes-152338
https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570612
https://updates.snyk.io/snyk-broker-security-fixes-152338

Get alerted when CVE-2020-7653 or the next vulnerability affects your stack