{"id":"GHSA-j9wj-m24m-7jj6","summary":"willitmerge has a Command Injection vulnerability","details":"willitmerge describes itself as a command line tool to check if pull requests are mergeable. There is a Command Injection vulnerability in version `willitmerge@0.2.1`.\n\nResources: \n * Project's GitHub source code: https://github.com/shama/willitmerge/\n * Project's npm package: https://www.npmjs.com/package/willitmerge\n\n## Background on exploitation\n\nReporting a Command Injection vulnerability in `willitmerge` npm package.\n\nA security vulnerability manifests in this package due to the use of insecure child process execution API (`exec`) to which it concateanes user input, whether provided to the command-line flag, or is in user control in the target repository.\n\n## Exploit \n\n### POC 1\n\n1. Install `willitmerge`\n2. Run it with the following command\n\n```sh\nwillitmerge --verbose --remote \"https://github.com/lirantal/npq.git; touch /tmp/hel\"\n```\n\n3. Confirm the file `/tmp/hel` is created on disk\n\n### GitHub-sourced attack vector\n\n[Lines 189-197](https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197) in `lib/willitmerge.js`\npass user input controlled by repository collaborators into the git command:\n\n```js\n  var cmds = [\n    'git checkout -b ' + branch + ' ' + that.options.remote + '/' + iss.base.ref,\n    'git remote add ' + branch + ' ' + gitUrl,\n    'git pull ' + branch + ' ' + iss.head.ref,\n    'git reset --merge HEAD',\n    'git checkout ' + origBranch,\n    'git branch -D ' + branch,\n    'git remote rm ' + branch\n  ];\n```\n\nUsers creating malicious branch names such as `;{echo,hello,world}\u003e/tmp/c`\n\nThis is a similar attack vector to that which was reported for the [pullit vulnerability (https://security.snyk.io/vuln/npm:pullit:20180214)\n\n# Author\n\nLiran Tal","aliases":["CVE-2025-66219"],"modified":"2025-12-01T17:03:45.099642Z","published":"2025-11-26T22:09:27Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-11-26T22:09:27Z","nvd_published_at":"2025-11-29T02:15:52Z","cwe_ids":["CWE-77"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66219"},{"type":"PACKAGE","url":"https://github.com/shama/willitmerge"},{"type":"WEB","url":"https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197"}],"affected":[{"package":{"name":"willitmerge","ecosystem":"npm","purl":"pkg:npm/willitmerge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.2.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-j9wj-m24m-7jj6/GHSA-j9wj-m24m-7jj6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}