CVE-2025-66219

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197	Product
https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6	Exploit Vendor Advisory
https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dontkry:willitmerge:*:*:*:*:*:node.js:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) willitmerge es una herramienta de línea de comandos para verificar si las solicitudes de extracción son fusionables. En las versiones 0.2.1 y anteriores, existe una vulnerabilidad de inyección de comandos en willitmerge. La vulnerabilidad se manifiesta en este paquete debido al uso de una API (exec) de ejecución de procesos secundarios insegura a la que concatena la entrada del usuario, ya sea proporcionada al indicador de línea de comandos o que está bajo el control del usuario en el repositorio de destino. En el momento de la publicación, no se conoce ninguna solución pública.

Information

Published : 2025-11-29 02:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-66219

Mitre link : CVE-2025-66219

CVE.ORG link : CVE-2025-66219

JSON object : View

Products Affected

dontkry

willitmerge

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-66219", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66219", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T18:43:43.662991Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "shama", "product": "willitmerge", "versions": [{"status": "affected", "version": "<= 0.2.1"}]}]}], "published": "2025-11-29T02:15:52.577", "references": [{"url": "https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public."}, {"lang": "es", "value": "willitmerge es una herramienta de l\u00ednea de comandos para verificar si las solicitudes de extracci\u00f3n son fusionables. En las versiones 0.2.1 y anteriores, existe una vulnerabilidad de inyecci\u00f3n de comandos en willitmerge. La vulnerabilidad se manifiesta en este paquete debido al uso de una API (exec) de ejecuci\u00f3n de procesos secundarios insegura a la que concatena la entrada del usuario, ya sea proporcionada al indicador de l\u00ednea de comandos o que est\u00e1 bajo el control del usuario en el repositorio de destino. En el momento de la publicaci\u00f3n, no se conoce ninguna soluci\u00f3n p\u00fablica."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dontkry:willitmerge:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "252A8A35-2C13-464A-B6D1-D88B1160A2A2", "versionEndIncluding": "0.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}