-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability analysis identified a critical command injection flaw in the interactive-git-checkout package. The root cause is the unsafe use of the child_process.exec function with user-controlled input across multiple files. The fixing commit 8dd832dd302af287a61611f4f85e157cd1c6bb41 addresses this by replacing exec with the more secure execFile function. execFile is not vulnerable to command injection in the same way because it treats arguments as separate tokens rather than parsing them in a shell.
The primary vulnerable functions are the anonymous functions exported by src/checkout.js and src/checkoutToNew.js. These functions directly incorporate user-provided branch names into the command string passed to exec, allowing an attacker to inject and execute arbitrary commands. A third function in src/getBranches.js was also patched, likely as a proactive security hardening measure, although it doesn't appear to be directly exploitable via user input.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| interactive-git-checkout | npm | <= 1.1.4 |
A Semantic Attack on Google Gemini - Read the Latest Research