PT-2025-36999 · Unknown · Interactive-Git-Checkout

Lirantal · Published 2025-09-09 · Updated 2025-09-10 · CVE-2025-59046

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: interactive-git-checkout versions up to and including 1.1.4

Description: The interactive-git-checkout tool is an interactive command-line utility for checking out Git branches. Versions up to and including 1.1.4 are susceptible to a command injection issue. This occurs because the software utilizes the Node.js child process module’s exec() function to pass the branch name to the git checkout command without sufficient input validation or sanitization.

Recommendations: Update to a version after 1.1.4.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-14328

CVE-2025-59046

GHSA-4WCM-7HJF-6XW5

Affected Products

Interactive-Git-Checkout

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59046.json · Exploit
• 🔥 https://github.com/ninofiliu/interactive-git-checkout/security/advisories/GHSA-4wcm-7hjf-6xw5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59046 · Security Note
• https://bdu.fstec.ru/vul/2025-14328 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59046 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4wcm-7hjf-6xw5 · Vendor Advisory
• https://github.com/ninofiliu/interactive-git-checkout/commit/8dd832dd302af287a61611f4f85e157cd1c6bb41 · Note
• https://github.com/ninofiliu/interactive-git-checkout · Note
• https://twitter.com/CVEnew/status/1965557667448947001 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1965604817281200418 · Twitter Post