EUVD-2026-252360

fkie_cve-2025-59046

The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts for the branch name on the command-line. It is available as an npm package and can be installed via `npm install -g interactive-git-checkout`. Versions up to and including 1.1.4 of the `interactive-git-checkout` tool are vulnerable to a command injection vulnerability because the software passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization. Commit 8dd832dd302af287a61611f4f85e157cd1c6bb41 fixes the issue.

GHSA-4wcm-7hjf-6xw5 — interactive-git-checkout has a Command Injection vulnerability

Affected: npm: interactive-git-checkout

Resources: * Project's npm package: https://www.npmjs.com/package/interactive-git-checkout ## Command Injection Vulnerability

The `interactive-git-checkout` tool is vulnerable to a command injection vulnerability because it passes the branch name to the `git checkout` command using the Node.js child process module's `exec()` function without proper input validation or sanitization.

The following vulnerable code snippets demonstrates the issue:

```js const { exec: execCb } = require('child_process'); const { promisify } = require('util');

const exec = promisify(execCb);

module.exports = async (targetBranch) => { const { stdout, stderr } = await exec(`git checkout ${targetBranch}`); process.stderr.write(stderr); process.stdout.write(stdout); }; ```

## Exploit Proof of Concept

1. Install the `interactive-git-checkout` package (as suggested by the package's README):

```bash npm install --global interactive-git-checkout ```

2. Run the executable exposed by the installed package:

```bash $ igc ```

3. When prompted, enter the following branch name:

```bash hello ; echo 'Command Injection Vulnerability Exploited!' > /tmp/command-injection.txt; # ```

## Vulnerable versions

All…

Most recent entries from all

bdu:2025-14328

EUVD-2026-252360

fkie_cve-2025-59046

GHSA-4wcm-7hjf-6xw5 — interactive-git-checkout has a Command Injection vulnerability