CVE-2025-11148
Severity CVSS v4.0:
Pending analysis
Type:
CWE-78
OS Command Injections
Publication date:
30/09/2025
Last modified:
02/10/2025
Description
All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.<br />
<br />
However, the library follows these conventions which can be abused:<br />
1. It trusts branch names as they are (plain text)<br />
2. It spawns git commands by concatenating user input<br />
<br />
Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL