CVE-2025-11148: check-branches is vulnerable to command Injection

The vulnerability exists because the check-branches tool constructs shell commands by concatenating user-controllable input (git branch names) without proper sanitization. The analysis of the source code in src/index.ts reveals that the child_process.exec function is used to run git commands.

The getBranchContributors function takes a branch name as input and directly embeds it into a git log command, making it vulnerable. Similarly, the main check function, which is the primary entry point of the CLI tool, constructs and executes several git commands (git checkout, git merge) using branch names. Since branch names can be crafted by an attacker to contain arbitrary shell commands (e.g., my-branch; rm -rf /), running check-branches in a repository with such a branch will lead to command injection. The proof-of-concept confirms this by creating a branch named ";{echo,hello,world}>/tmp/d" which, when processed by the tool, executes the echo command and redirects the output to a file.