PT-2025-48356 · Unknown · Willitmerge

Lirantal · Published 2025-11-29 · Updated 2025-12-19 · CVE-2025-66219

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions willitmerge versions 0.2.1 and prior

Description willitmerge is a command line tool used to check if pull requests are mergeable. A command injection issue exists because the software uses an insecure child process execution API (exec) and concatenates user-supplied data to it. User input, whether provided through command-line flags or controlled within the target repository, is not properly sanitized before being used in the exec function. This allows for potential arbitrary command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-66219

GHSA-J9WJ-M24M-7JJ6

Affected Products

Willitmerge

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66219.json · Exploit
• 🔥 https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66219 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66219 · Vendor Advisory
• https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197 · Note
• https://t.me/cveNotify/146335 · Telegram Post
• https://t.me/CVEtracker/38453 · Telegram Post
• https://twitter.com/The_SatyaDVV/status/1994707939911758065 · Twitter Post
• https://twitter.com/SecAideInfo/status/1995437342233124982 · Twitter Post