要点
- CVE-2025-11148 は check-branches に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：1.4%（全脆弱性の 71.6% より高い）。
- 修正版の情報はまだありません。参考情報のベンダー勧告を確認してください。
概要
All versions of the package check-branches are vulnerable to Command Injection.
check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.
However, the library follows these conventions which can be abused:
- It trusts branch names as they are (plain text)
- It spawns git commands by concatenating user input
Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.
NVD の説明
All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.
However, the library follows these conventions which can be abused:
1. It trusts branch names as they are (plain text)
2. It spawns git commands by concatenating user input
Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン