CVE-2025-59046: interactive-git-checkout RCE Vulnerability

CVE-2025-59046 Overview

CVE-2025-59046 is a command injection vulnerability in the interactive-git-checkout npm package, an interactive command-line tool that allows users to checkout git branches while prompting for the branch name. Versions up to and including 1.1.4 are vulnerable because the software passes the branch name to the git checkout command using the Node.js child process module's exec() function without proper input validation or sanitization. This allows attackers to inject arbitrary shell commands through maliciously crafted branch names.

Critical Impact

Attackers can execute arbitrary commands on systems running vulnerable versions of interactive-git-checkout by crafting malicious input that gets passed unsanitized to a shell command, potentially leading to complete system compromise.

Affected Products

• interactive-git-checkout npm package versions <= 1.1.4

Discovery Timeline

• 2025-09-09 - CVE CVE-2025-59046 published to NVD
• 2025-09-11 - Last updated in NVD database

Technical Details for CVE-2025-59046

Vulnerability Analysis

This command injection vulnerability (CWE-77) exists due to improper handling of user-supplied input in the interactive-git-checkout package. The vulnerable code directly interpolates user-provided branch names into shell command strings, which are then executed via Node.js's child_process.exec() function. Unlike execFile(), the exec() function spawns a shell to execute the command, making it susceptible to shell metacharacter injection.

When a user provides a branch name containing shell metacharacters such as semicolons, backticks, or command substitution syntax, these characters are interpreted by the shell rather than being treated as literal strings. This allows an attacker to break out of the intended git checkout command and execute arbitrary system commands with the privileges of the user running the tool.

Root Cause

The root cause is the use of child_process.exec() with unsanitized user input. The vulnerable code constructs shell commands using template literals that directly incorporate the branch name parameter without any validation or escaping. The exec() function passes the entire string to a shell interpreter, which processes special characters and command separators, enabling command injection attacks.

Attack Vector

The attack is executed through the network vector when a malicious repository contains specially crafted branch names, or locally when an attacker can influence the branch name input. An attacker could create a branch name like main; rm -rf / or use command substitution syntax like `whoami` to execute arbitrary commands. Since the tool prompts for branch names interactively, any context where an attacker can influence the input (including social engineering or malicious repository configurations) presents an exploitation opportunity.

// Vulnerable code pattern (src/checkout.js)
-const { exec: execCb } = require('child_process');
+const { execFile: execFileCb } = require('child_process');
 const { promisify } = require('util');
 
-const exec = promisify(execCb);
+const execFile = promisify(execFileCb);
 
 module.exports = async (targetBranch) => {
-    const { stdout, stderr } = await exec(`git checkout ${targetBranch}`);
+    const { stdout, stderr } = await execFile('git', ['checkout', targetBranch]);
     process.stderr.write(stderr);
     process.stdout.write(stdout);
 };

Source: GitHub Commit Update

Detection Methods for CVE-2025-59046

Indicators of Compromise

• Unusual process spawning from Node.js applications, particularly unexpected child processes
• Anomalous git-related command executions containing shell metacharacters or multiple commands
• Log entries showing branch names with special characters like ;, |, &, or backticks
• Unexpected system modifications or network connections originating from npm package processes

Detection Strategies

• Monitor for child_process.exec() calls with user-controlled input in Node.js application logs
• Implement runtime application self-protection (RASP) to detect command injection attempts
• Use static code analysis tools to identify vulnerable patterns in JavaScript codebases
• Deploy endpoint detection rules that alert on suspicious command chaining in git operations

Monitoring Recommendations

• Enable audit logging for shell command executions on systems running Node.js applications
• Configure alerting for any git checkout commands containing non-alphanumeric characters beyond standard branch naming conventions
• Monitor npm package versions across development environments to identify outdated dependencies
• Implement file integrity monitoring on critical system directories to detect post-exploitation modifications

How to Mitigate CVE-2025-59046

Immediate Actions Required

• Upgrade interactive-git-checkout to a version containing commit 8dd832dd302af287a61611f4f85e157cd1c6bb41 or later
• Audit your codebase for similar patterns using child_process.exec() with user input
• Review all npm dependencies for known command injection vulnerabilities
• Implement input validation to restrict branch names to alphanumeric characters, hyphens, and forward slashes

Patch Information

The vulnerability is fixed in commit 8dd832dd302af287a61611f4f85e157cd1c6bb41. The fix replaces the vulnerable exec() function with execFile(), which does not spawn a shell and passes arguments as an array rather than a concatenated string. This prevents shell metacharacter interpretation and eliminates the command injection vector. For detailed patch information, refer to the GitHub Security Advisory GHSA-4wcm-7hjf-6xw5.

Workarounds

• Avoid using vulnerable versions of the package until you can upgrade
• Implement a wrapper script that validates branch names against a strict allowlist pattern before passing to the tool
• Use alternative git checkout tools that properly sanitize input
• Restrict the execution environment using containers or sandboxing to limit the impact of potential exploitation

# Configuration example
# Validate branch name before using interactive-git-checkout
BRANCH_NAME="$1"
if [[ ! "$BRANCH_NAME" =~ ^[a-zA-Z0-9/_-]+$ ]]; then
    echo "Error: Invalid branch name characters detected"
    exit 1
fi
# Proceed with checkout only if validation passes