CVE-2025-59046 — AI Deep Analysis Summary

🚨 **Essence**: A critical **Command Injection** flaw in `interactive-git-checkout`. <br>💥 **Consequences**: Attackers can execute arbitrary system commands.…

🛡️ **Root Cause**: **CWE-77** (Command Injection). <br>🔍 **Flaw**: The application does **not validate or clean** user-supplied branch names.…

👥 **Affected**: Users of **`interactive-git-checkout`** by developer **Nino Filiu**. <br>📦 **Versions**: All versions **1.1.4 and earlier** are vulnerable. If you are running an older build, you are at risk.

💀 **Attacker Capabilities**: <br>🔓 **Privileges**: Full **system-level access** (equivalent to the user running the tool). <br>📂 **Data**: Can read, modify, or delete any file accessible to the process.…

⚡ **Exploitation Threshold**: **LOW**. <br>🔑 **Auth**: **None required** (PR:N). <br>🖱️ **UI**: **None required** (UI:N). <br>🌐 **Access**: **Network** accessible (AV:N). <br>🎯 **Complexity**: **Low** (AC:L).…

📢 **Public Exploit**: **No PoC provided** in the advisory data. <br>🌍 **Wild Exploitation**: Unconfirmed.…

🔍 **Self-Check**: <br>1️⃣ Check your installed version: `interactive-git-checkout --version`. <br>2️⃣ If version ≤ **1.1.4**, you are vulnerable.…

✅ **Official Fix**: **YES**. <br>🔗 **Patch**: See GitHub Advisory **GHSA-4wcm-7hjf-6xw5**. <br>🛠️ **Commit**: Fixed in commit `8dd832dd302af287a61611f4f85e157cd1c6bb41`. Update immediately to the latest version.

🚧 **No Patch Workaround**: <br>⛔ **Disable** the tool if possible. <br>🚫 **Do not** use branch names containing shell metacharacters (`|`, `;`, `$`, `` ` ``).…

🔥 **Urgency**: **CRITICAL / IMMEDIATE ACTION REQUIRED**. <br>📉 **Priority**: **P0**. With a CVSS of **9.8** and no authentication needed, this is a high-severity threat.…