{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.0.19"}],"component":"check-branches","cve_ids":["CVE-2025-11148"],"ecosystem":"npm","epss":0.01354,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9c4g-fp4r-prrv","id":"tcs_01M5KFFF8ESGXVTPAXVB7FP9SG","modified_at":"2025-10-03T18:22:21Z","published_at":"2025-09-30T12:30:51Z","references":["https://osv.dev/vulnerability/GHSA-9c4g-fp4r-prrv","https://nvd.nist.gov/vuln/detail/CVE-2025-11148","https://gist.github.com/lirantal/054b4ad039a86c418f2c84e3e884d6ec","https://github.com/puntorigen/check-branches","https://security.snyk.io/vuln/SNYK-JS-CHECKBRANCHES-2766494"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-9c4g-fp4r-prrv","url":"https://osv.dev/vulnerability/GHSA-9c4g-fp4r-prrv"}],"summary":"check-branches is vulnerable to command Injection"}