AIKIDO-2026-10934
@sentry/cli is vulnerable to Argument Injection
77
High Risk
This Affects:
@sentry/cliTL;DR
The @sentry/cli package contains related CLI argument handling and credential exposure flaws. The JavaScript wrapper can flatten attacker-influenced array values into extra native sentry-cli command arguments, allowing injected flags such as --auth-token. In affected native binaries, sentry-cli build snapshots also sends the Sentry bearer token to Objectstore in the Authorization header, exposing a long-lived secret to an additional service boundary. The patch rejects non-primitive wrapper option values and removes the Sentry bearer token from Objectstore requests.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@sentry/cli is vulnerable to Argument Injection in versions 0.0.1 - 3.4.1.
How to fix this
Upgrade the @sentry/cli library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.