CVE-2025-11148 — Vulnerability in check-branches — CVE Details

CRITICAL

check-branches is vulnerable to command Injection

Published September 30, 2025Updated October 3, 2025Source: osv

Summary

All versions of the package check-branches are vulnerable to Command Injection. check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches. However, the library follows these conventions which can be abused: 1. It trusts branch names as they are (plain text) 2. It spawns git commands by concatenating user input Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.

Advisory Timeline

First published September 30, 2025 (377 days ago).
Last revised October 3, 2025 — 3 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

Package	Ecosystem	Affected	Fixed In
check-branches	npm	All versions	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-77
View on MITRE
CWE-78
OS Command InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-11148?: check-branches is vulnerable to command Injection This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2025-11148?: CVE-2025-11148 affects check-branches. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-11148 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-9c4g-fp4r-prrv

Related CVEs

CVE-2026-107722
CRITICAL
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
CVE-2026-108261
CRITICAL
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies