by Kastro
Paper/Archive/CVE-2025-66219

CVE-2025-66219

shama willitmerge — willitmerge has a command Injection vulnerability

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.7.857 × 2017.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.

Affected

ProductAffectedFixed inSource
willitmerge<= 0.2.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6refgithub.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197