Back to overview

CVE-2025-11148

CRITICAL Exploitation: PoC
9.8
CVSS 3.1
Description
All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches. However, the library follows these conventions which can be abused: 1. It trusts branch names as they are (plain text) 2. It spawns git commands by concatenating user input Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.

Metadata

CVE ID
CVE-2025-11148
State
PUBLISHED
Assigner
snyk
Reserved
2025-09-29 09:12 UTC
Published
2025-09-30 05:00 UTC
Last updated
2025-09-30 19:06 UTC
Primary CWE
CWE-78
Command Injection
Vendor / Product
n/a / check-branches
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
n/a check-branches — 0 < *
Weakness (CWE)
CWESourceDescription
CWE-78 cna Command Injection
CWE-78 adp CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (2)
Back to overview