CVE-2025-66219: Willitmerge Willitmerge Has A Command Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j9wj-m24m-7jj6",
  "modified" : "2025-12-01T16:06:54Z",
  "published" : "2025-11-26T22:09:27Z",
  "aliases" : [ "CVE-2025-66219" ],
  "summary" : "willitmerge has a Command Injection vulnerability",
  "details" : "willitmerge describes itself as a command line tool to check if pull requests are mergeable. There is a Command Injection vulnerability in version `willitmerge@0.2.1`.\n\nResources: \n * Project's GitHub source code: https://github.com/shama/willitmerge/\n * Project's npm package: https://www.npmjs.com/package/willitmerge\n\n## Background on exploitation\n\nReporting a Command Injection vulnerability in `willitmerge` npm package.\n\nA security vulnerability manifests in this package due to the use of insecure child process execution API (`exec`) to which it concateanes user input, whether provided to the command-line flag, or is in user control in the target repository.\n\n## Exploit \n\n### POC 1\n\n1. Install `willitmerge`\n2. Run it with the following command\n\n```sh\nwillitmerge --verbose --remote \"https://github.com/lirantal/npq.git; touch /tmp/hel\"\n```\n\n3. Confirm the file `/tmp/hel` is created on disk\n\n### GitHub-sourced attack vector\n\n[Lines 189-197](https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197) in `lib/willitmerge.js`\npass user input controlled by repository collaborators into the git command:\n\n```js\n  var cmds = [\n    'git checkout -b ' + branch + ' ' + that.options.remote + '/' + iss.base.ref,\n    'git remote add ' + branch + ' ' + gitUrl,\n    'git pull ' + branch + ' ' + iss.head.ref,\n    'git reset --merge HEAD',\n    'git checkout ' + origBranch,\n    'git branch -D ' + branch,\n    'git remote rm ' + branch\n  ];\n```\n\nUsers creating malicious branch names such as `;{echo,hello,world}>/tmp/c`\n\nThis is a similar attack vector to that which was reported for the [pullit vulnerability (https://security.snyk.io/vuln/npm:pullit:20180214)\n\n# Author\n\nLiran Tal",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "willitmerge"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "0.2.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-66219"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/shama/willitmerge"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-77" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-11-26T22:09:27Z",
    "nvd_published_at" : "2025-11-29T02:15:52Z"
  }
}