The interactive-git-checkout npm package contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary code on the host system.

The package suffers from a command injection vulnerability (CWE-77) where input handled during branch checkout is not properly sanitized. An attacker can exploit this to execute arbitrary system commands with the privileges of the user running the tool.

With a CVSS score of 9.8, this vulnerability poses a critical threat to development environments. An attacker could achieve full code execution on a developer's machine, leading to the theft of source code, credentials, or lateral movement into the organization's CI/CD pipeline.

Immediate Action: Cease use of interactive-git-checkout versions 1.1.4 and below immediately, as no official fix has been released.

Proactive Monitoring: Audit developer machines and CI/CD pipelines for the presence of this package and inspect shell history logs for suspicious command execution patterns.

Compensating Controls: Implement strict execution policies and use containerized environments with limited permissions to run development tools, reducing the impact of potential command injection.

Public Exploit Available: No (unknown)

Given the availability of a proof-of-concept and the critical nature of command injection, security teams must prioritize the removal of this package from all development environments. Developers should seek alternative, secure tools for git branch management until a patched version is verified.