VulnerabilityAnalyzed
CVE-2025-66219
In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge.
MEDIUM 6.9EPSS 2.66%
Does this matter?
Lower severity and a low EPSS score (2.66%). Track it; it rarely justifies an emergency change on its own.
Description
willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 2.66% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- dontkry/willitmerge
- Source
- security-advisories@github.com
References
- https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197Product
- https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6Exploit, Vendor Advisory
- https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.