Vulnerability · Published Nov 29, 2025 · Assigned by GitHub_M

CVE-2025-66219willitmerge has a command Injection vulnerability

Medium 6.9

In plain English

A medium-severity command injection in willitmerge from shama. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)2.7%top 14.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	willitmerge	no fix listed	GHSA-j9wj-m24m-7jj6

Affected products (as reported)

Vendor	Product	Versions
shama	willitmerge	<= 0.2.1

Weakness: CWE-77 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/shama/willitmerge/security/advisories/GHSA-j9wj-m24m-7jj6 x_refsource_CONFIRM
https://github.com/shama/willitmerge/blob/2fe91d05191fb05ac6da685828d109a3a5885028/lib/willitmerge.js#L189-L197 x_refsource_MISC