Command Injection Vulnerability in Check-Branches by Check-Branches Team

CVE-2025-11148

What is CVE-2025-11148?

The check-branches library presents a command injection vulnerability due to its handling of branch names. By trusting branch names as plain text and using user input to construct git commands, it opens the door for remote attackers to exploit this weakness. This can happen particularly through remote branch creation via pull requests or by privileged access to a repository, allowing malicious users to inject arbitrary commands. Proper validation and sanitization measures are crucial to mitigate this risk.

References