Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-66219

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:9eb859060ede745095e2c2a863464179121b0d3f66f8093f35d33a5d21d19204
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"willitmerge","vendor":"shama","versions":[{"status":"affected","version":"<= 0.2.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:02c584e7d67a83e25a4c4f06c981a32cd332bb89ac6da2aa65ec49eb1f2f97e7 · sha256:2f3d2e92ceee6f61… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:02c584e7d67a83e25a4c4f06c981a32cd332bb89ac6da2aa65ec49eb1f2f97e7 · sha256:2f3d2e92ceee6f61… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-77","description":"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:02c584e7d67a83e25a4c4f06c981a32cd332bb89ac6da2aa65ec49eb1f2f97e7 · sha256:2f3d2e92ceee6f61… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197","tags":["x_refsource_MISC"],"url":"https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:02c584e7d67a83e25a4c4f06c981a32cd332bb89ac6da2aa65ec49eb1f2f97e7 · sha256:2f3d2e92ceee6f61… · /containers/cna/references/1
{"tags":["exploit"],"url":"https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:02c584e7d67a83e25a4c4f06c981a32cd332bb89ac6da2aa65ec49eb1f2f97e7 · sha256:2f3d2e92ceee6f61… · /containers/adp/0/references/0
{"name":"https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6","tags":["x_refsource_CONFIRM"],"url":"https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:02c584e7d67a83e25a4c4f06c981a32cd332bb89ac6da2aa65ec49eb1f2f97e7 · sha256:2f3d2e92ceee6f61… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer