Cyber Posture

CVE-2025-66219

CriticalPublic PoC

Published: 29 November 2025

Published
29 November 2025
Modified
19 December 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 50.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process…

more

execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires identifying, documenting, and remediating the command injection flaw in willitmerge versions 0.2.1 and prior through patching, updating, or removal to eliminate the vulnerability.

prevent

Mandates validation and sanitization of untrusted user inputs from CLI flags and repository content before use in child process execution, blocking malicious command injection payloads.

prevent

Enforces execution of the willitmerge process with least privileges, confining the scope and impact of any successful command injection to minimal system access.

Security SummaryAI

CVE-2025-66219 is a command injection vulnerability (CWE-77) affecting the willitmerge command-line tool, a utility for checking if pull requests are mergeable. The issue impacts versions 0.2.1 and prior, stemming from the insecure use of the child process execution API (exec), where untrusted user input—either from command-line flags or content under user control in the target repository—is directly concatenated into the executed command. This flaw has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for remote exploitation with high impacts on confidentiality, integrity, and availability.

The vulnerability can be exploited by any remote attacker with network access to a system running the affected willitmerge versions, requiring no privileges, authentication, or user interaction. By supplying malicious input via CLI flags or manipulating repository content, an attacker can inject arbitrary operating system commands, leading to full command execution on the host system with the privileges of the willitmerge process. This enables attackers to achieve unauthorized access, data exfiltration, system compromise, or denial of service.

The GitHub security advisory (GHSA-j9wj-m24m-7jj6) details the vulnerability, with code references highlighting the insecure exec usage in lib/willitmerge.js (lines 189-197). At the time of publication on 2025-11-29, no public fix was available, so practitioners should avoid using affected versions, monitor for updates from the repository maintainer, and consider alternatives for pull request mergeability checks until a patch is released.

Details

CWE(s)

Affected Products

dontkry
willitmerge
≤ 0.2.1

MITRE ATT&CK Enterprise TechniquesAI

T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Command injection vulnerability via insecure child process exec allows arbitrary OS command execution, directly enabling T1059 Command and Scripting Interpreter.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References