CVE-2025-11148
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-78
Neutralización incorrecta de elementos especiales usados en un comando de sistema operativo (Inyección de comando de sistema operativo)
Fecha de publicación:
30/09/2025
Última modificación:
02/10/2025
Descripción
*** Pendiente de traducción *** All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.<br />
<br />
However, the library follows these conventions which can be abused:<br />
1. It trusts branch names as they are (plain text)<br />
2. It spawns git commands by concatenating user input<br />
<br />
Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.
Impacto
Puntuación base 3.x
9.80
Gravedad 3.x
CRÍTICA