CVE-2025-11148: check-branches is vulnerable to command Injection
All versions of the package check-branches are vulnerable to Command Injection. check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches. However, the library follows these conventions which can be abused: 1. It trusts branch names as they are (plain text) 2.
Published Sep 30, 2025 · Updated Oct 3, 2025
Affected packages
check-branches
- Ecosystem
- npm
- Affected
- <= 0.0.19
- Fixed in
- No patched version yet
- Check
npm ls check-branches
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
All versions of the package check-branches are vulnerable to Command Injection.
check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.
However, the library follows these conventions which can be abused:
- It trusts branch names as they are (plain text)
- It spawns git commands by concatenating user input
Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.
Credited to lirantal.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology