What’s Vulnerable › Vulnerabilities

CVE-2025-66219: willitmerge has a command Injection vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-29 · updated 2026-10-07
• Weakness: CWE-77

Description

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.

Affected products

• shama willitmerge: through 0.2.1

References

• https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197
• https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6
• https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6

Get alerted when CVE-2025-66219 or the next vulnerability affects your stack