« Volver al listado

CVE-2025-11148

Estado: AplazadaCrítica (9.8)—

All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.

However, the library follows these conventions which can be abused: 1. It trusts branch names as they are (plain text) 2. It spawns git commands by concatenating user input

Since a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-78 (inyección de comandos) en herramienta CLI con AV:N/PR:N permite RCE remota sin autenticación concatenando nombres de rama en comandos git; escalada a T1068 si se ejecuta con privilegios en CI/CD.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability Scanning

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Check-branches — Check-branchesAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-11148",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11148",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-30T19:05:55.619766Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "report@snyk.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "report@snyk.io",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "check-branches",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "*",
              "versionType": "semver"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-09-30T11:37:38.883",
  "references": [
    {
      "url": "https://gist.github.com/lirantal/054b4ad039a86c418f2c84e3e884d6ec",
      "source": "report@snyk.io"
    },
    {
      "url": "https://security.snyk.io/vuln/SNYK-JS-CHECKBRANCHES-2766494",
      "source": "report@snyk.io"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "report@snyk.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.\r\rHowever, the library follows these conventions which can be abused:\r1. It trusts branch names as they are (plain text)\r2. It spawns git commands by concatenating user input\r\rSince a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command."
    },
    {
      "lang": "es",
      "value": "Todas las versiones del paquete check-branches son vulnerables a Inyección de comandos. check-branches es una herramienta de línea de comandos con la que se interactúa localmente, o a través de CI, para confirmar que no existen conflictos en las ramas de git. Sin embargo, la biblioteca sigue estas convenciones que pueden ser explotadas:\n1. Confía en los nombres de las ramas tal como están (texto plano)\n2. Genera comandos de git concatenando la entrada del usuario\nDado que el nombre de una rama es potencialmente una entrada de usuario - ya que los usuarios pueden crear ramas de forma remota a través de solicitudes de extracción (pull requests), o simplemente debido a un acceso privilegiado a un repositorio - puede ser explotado eficazmente para ejecutar cualquier comando."
    }
  ],
  "lastModified": "2026-06-17T08:29:45.187",
  "sourceIdentifier": "report@snyk.io"
}